Weaknesses of type CWE-79

29,250 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-57101HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2024-13803MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-5316CRITICALCross-site Scripting (XSS) - DOM in thorsten/phpmyfaqEPSS 0.5%CVE-2024-47947MEDIUMStored cross site scriptingEPSS 0.5%CVE-2022-46148HIGHDiscourse allows self-XSS through malicious composer messageEPSS 0.5%CVE-2023-2436MEDIUMBlog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-31928MEDIUMXSS vulnerability in Brocade WebtoolsEPSS 0.5%CVE-2022-39279MEDIUMDiscourse-chat plugin susceptible to XSS in channel name and descriptionEPSS 0.5%CVE-2022-39270MEDIUMArbitrary HTML injection in table-of-contents theme component in DiscoTOCEPSS 0.5%CVE-2024-33670MEDIUMPassbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the craftEPSS 0.5%CVE-2023-1869MEDIUMYourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-28680MEDIUMDedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php.EPSS 0.5%CVE-2023-4271MEDIUMPhotospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-27169HIGHOpenSift: Persistent XSS Chat Tool RenderingEPSS 0.5%CVE-2026-81899HIGHConcrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboardEPSS 0.5%CVE-2023-44389LOWZope management interface vulnerable to stored cross site scripting via the title propertyEPSS 0.5%CVE-2025-62694MEDIUMStored XSS through a system messageEPSS 0.5%CVE-2024-51377HIGHAn issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary coEPSS 0.5%CVE-2026-85129HIGHHoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings ImportEPSS 0.5%CVE-2024-0442MEDIUMRoyal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%