Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-10032MEDIUMArbitrary JavaScript Execution via openUrl in @a2ui/web_coreEPSS 0.1%CVE-2025-64059LOWGrav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admEPSS 0.1%CVE-2026-87973LOWIf-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion NameEPSS 0.1%CVE-2026-8203HIGHConcrete CMS 9.5.0 and below has Stored XSS on the height parameterEPSS 0.1%CVE-2026-78325MEDIUMXSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML ImportEPSS 0.1%CVE-2026-48822MEDIUMShaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference LinksEPSS 0.1%CVE-2026-11936MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-48823MEDIUMShaarli has Stored Cross-Site Scripting (XSS) via Tags SearchEPSS 0.1%CVE-2026-25599MEDIUMMissing authentication and clear‑text data transmission affecting Orca heat pumpsEPSS 0.1%CVE-2025-66521MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Trusted Certificates FeatureEPSS 0.1%CVE-2026-42558HIGHXibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSetEPSS 0.1%CVE-2016-20054MEDIUMNodcms Cross Site Request Forgery via admin endpointsEPSS 0.1%CVE-2026-27964LOWFacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie ManipulationEPSS 0.1%CVE-2026-29136MEDIUMCA Notification HTML InjectionEPSS 0.1%CVE-2026-41886HIGHlocize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext EditorEPSS 0.1%CVE-2026-113810HIGHStored XSS on SNS Enrollment PortalEPSS 0.1%CVE-2026-34822MEDIUMEndian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-4364MEDIUMSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-46342LOWNuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningEPSS 0.1%CVE-2026-109150HIGHWP PageNavi Style <= 1.4 - Stored XSS via CSRFEPSS 0.1%