Weaknesses of type CWE-79

30,642 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-8078MEDIUMFix stored XSS in global settings change logEPSS 0.1%CVE-2026-34820MEDIUMEndian Firewall /manage/ipsec/ remark Stored Cross-Site ScriptingEPSS 0.1%CVE-2025-71276MEDIUMSOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.EPSS 0.1%CVE-2026-31153MEDIUMA stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTMLEPSS 0.1%CVE-2026-34817MEDIUMEndian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-34815MEDIUMEndian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-9549MEDIUMFix XSS in service discovery active check outputEPSS 0.1%CVE-2026-42643MEDIUMWordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-34814MEDIUMEndian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-34809MEDIUMEndian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-34808MEDIUMEndian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-3495LOWUnescaped variables during error page compositionEPSS 0.1%CVE-2026-26352MEDIUMSmoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP ParameterEPSS 0.1%CVE-2026-48212MEDIUMStored XSS in external pagesEPSS 0.1%CVE-2025-70936MEDIUMVtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controllEPSS 0.1%CVE-2026-35054MEDIUMXenForo Stored Cross-Site Scripting via BB Code RenderingEPSS 0.1%CVE-2026-34810MEDIUMEndian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-87971HIGHIf-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' ParameterEPSS 0.1%CVE-2026-97263HIGHWordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-94063HIGHWordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%