Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-23757MEDIUMGFI HelpDesk < 4.99.10 Stored XSS via Reports ModuleEPSS 0.1%CVE-2026-31953MEDIUMXibo CMS has Stored XSS via Notification Body with Zero-Click Execution on LoginEPSS 0.1%CVE-2026-53742MEDIUMSimple Link Directory through 9.0.4 Stored XSS via Embed Shortcode AttributesEPSS 0.1%CVE-2026-44229MEDIUMRT: Cross-Site Scripting via inline-served uploaded contentEPSS 0.1%CVE-2026-53740MEDIUMYoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish NoticeEPSS 0.1%CVE-2026-48541MEDIUMKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name FieldEPSS 0.1%CVE-2026-23756MEDIUMGFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step SubjectEPSS 0.1%CVE-2026-53741MEDIUMSimple Link Directory through 9.0.4 Stored XSS via sld_no_results_found OptionEPSS 0.1%CVE-2026-8833HIGHXSS in urlsEPSS 0.1%CVE-2025-15658MEDIUMWordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-27852MEDIUMThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attEPSS 0.1%CVE-2026-117679MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's EPSS 0.1%CVE-2026-8012MEDIUMInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proEPSS 0.1%CVE-2026-8080MEDIUMMISP core - Stored XSS in MISP template (old engine) element attribute typeEPSS 0.1%CVE-2026-94488HIGHTelegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 EPSS 0.1%CVE-2026-93460MEDIUMA stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploitedEPSS 0.1%CVE-2026-47901MEDIUMIframe escape by plugins in LogseqEPSS 0.1%CVE-2026-3107CRITICALMultiple vulnerabilities in TeampassEPSS 0.1%CVE-2026-40734MEDIUMWordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-40927MEDIUMDocmost: XSS in Comments with JavaScript URIEPSS 0.1%