Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-46609MEDIUMUmbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogEPSS 0.1%CVE-2026-7186HIGHFix stored XSS in URL dashboard widget via dangerous URI schemesEPSS 0.1%CVE-2026-45580MEDIUMWWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeEPSS 0.1%CVE-2026-28116MEDIUMWordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-78407MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-56009MEDIUMWordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-62127MEDIUMWordPress WEN Logo Slider plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42451MEDIUMGrimmory: Stored XSS via Malicious EPUB Enables Session Token TheftEPSS 0.1%CVE-2026-18541MEDIUMIBM Planning Analytics Local is affected by security vulnerabilitiesEPSS 0.1%CVE-2026-24754MEDIUMKiteworks Secure Data Forms Vulnerable to Cross-site ScriptingEPSS 0.1%CVE-2025-58430HIGHlistmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverEPSS 0.1%CVE-2026-57439MEDIUMCyberChef: Prototype pollution in Series Chart operationEPSS 0.1%CVE-2026-39696MEDIUMWordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-39703MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-109691MEDIUMWordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-109697MEDIUMWordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-34890MEDIUMWordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108490MEDIUMWordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108488MEDIUMWordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105881MEDIUMWordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%