Weaknesses of type CWE-79

29,592 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-83546MEDIUMCoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class AttributeEPSS 0.4%CVE-2024-51856MEDIUMWordPress Moose Elementor Kit plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-88993MEDIUMAll Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type AttributeEPSS 0.4%CVE-2023-32686HIGHkiwitcms vulnerable to stored XSS via unrestricted files uploadEPSS 0.4%CVE-2026-83547MEDIUMXpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple WidgetsEPSS 0.4%CVE-2026-16260MEDIUMPost Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title FieldEPSS 0.4%CVE-2024-24905HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network EPSS 0.4%CVE-2026-14827MEDIUMCalendar < 1.3.18 - Contributor+ Stored XSS via event_link ParameterEPSS 0.4%CVE-2026-76546MEDIUMProfile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date ShortcodeEPSS 0.4%CVE-2026-83532MEDIUMCustom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode AttributesEPSS 0.4%CVE-2026-86780MEDIUMFeatured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt TextEPSS 0.4%CVE-2026-92140MEDIUMJenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resultEPSS 0.4%CVE-2026-84902MEDIUMKing Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog ImportEPSS 0.4%CVE-2026-88788MEDIUMText Styler <= 1.1.1 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-16293MEDIUMBlubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URLEPSS 0.4%CVE-2026-74992MEDIUMKirki < 6.2.3 - Editor+ Stored XSS via Font Zip UploadEPSS 0.4%CVE-2024-4650LOWCampcodes Complete Web-Based School Management System student_due_payment.php cross site scriptingEPSS 0.4%CVE-2026-82847MEDIUMMasteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course HighlightsEPSS 0.4%CVE-2026-84896MEDIUMKing Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid WidgetEPSS 0.4%CVE-2026-84223MEDIUMKirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG UploadEPSS 0.4%