Weaknesses of type CWE-79

29,506 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-46516MEDIUMFrogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)EPSS 0.4%CVE-2023-28664MEDIUMThe Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in EPSS 0.4%CVE-2024-4624MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4652LOWCampcodes Complete Web-Based School Management System show_teacher2.php cross site scriptingEPSS 0.4%CVE-2026-18323HIGHForminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)EPSS 0.4%CVE-2026-11942MEDIUMAkaunting 3.1.21 - Stored XSS in delete confirmation modalEPSS 0.4%CVE-2023-28666MEDIUMThe InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' paraEPSS 0.4%CVE-2022-4959LOWqkmc-rk redbbs Nickname cross site scriptingEPSS 0.4%CVE-2025-25203HIGHCtrlpanel has stored XSS vulnerability in TicketsController priority fieldEPSS 0.4%CVE-2023-47816MEDIUMWordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-5338MEDIUMTheme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2021-4046MEDIUMTCMAN GIM Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-23820MEDIUMWordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23830HIGHWordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-65754MEDIUMCross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filEPSS 0.4%CVE-2026-27614CRITICALBugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace renderingEPSS 0.4%CVE-2024-29034MEDIUMCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedEPSS 0.4%CVE-2026-24769HIGHNocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadEPSS 0.4%CVE-2024-42762MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows EPSS 0.4%CVE-2023-5861MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.4%