Weaknesses of type CWE-79

30,640 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-32868MEDIUMOPEXUS eComplaint and eCASE XSS via my informationEPSS 0.1%CVE-2026-45778HIGHOpen XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password ResetEPSS 0.1%CVE-2026-116887MEDIUMSemantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword PropertyEPSS 0.1%CVE-2026-32866MEDIUMOPEXUS eComplaint and eCase stored XSS via profile first and last nameEPSS 0.1%CVE-2026-34848MEDIUMhoppscotch: Stored XSS in team member overflow tooltip via display nameEPSS 0.1%CVE-2026-32544HIGHWordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-29510MEDIUMHereta ETH-IMC408M Stored XSS via Device NameEPSS 0.1%CVE-2026-32532HIGHWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-116886MEDIUMSemantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:BrowseEPSS 0.1%CVE-2026-27787MEDIUMCross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be exEPSS 0.1%CVE-2026-32869MEDIUMOPEXUS eComplaint and eCASE XSS via Name of Organization fieldEPSS 0.1%CVE-2026-82326MEDIUMHTML Injection in Enocta Educational's Enocta PlatformEPSS 0.1%CVE-2026-54861HIGHWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-94058HIGHWordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-3278HIGHXSS Vulnerability discovered in OpenText™ ZENworks Service Desk.EPSS 0.1%CVE-2026-93951HIGHWordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97264HIGHWordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-31013HIGHWordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-112863HIGHWordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-57666HIGHWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%