Weaknesses of type CWE-79

29,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-13441HIGHEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' ParameterEPSS 0.4%CVE-2024-8572MEDIUMGouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scriptingEPSS 0.4%CVE-2024-3990MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover WidgetEPSS 0.4%CVE-2022-43696MEDIUMOX App Suite before 7.10.6-rev20 allows XSS via upsell ads.EPSS 0.4%CVE-2024-56199MEDIUMphpMyFAQ Vulnerable to Stored HTML Injection at FAQEPSS 0.4%CVE-2026-77263HIGHiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.4%CVE-2026-31281HIGHTotara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all thEPSS 0.4%CVE-2026-18109HIGHW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.4%CVE-2024-11456MEDIUMRun Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-84803HIGHSiYuan before v3.8.2 Stored XSS via incomplete asset blocklistEPSS 0.4%CVE-2022-33935MEDIUMDell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit thEPSS 0.4%CVE-2026-31803HIGHCombodo iTop: Reflected XSS in tag adminEPSS 0.4%CVE-2024-6355MEDIUMGenexis Tilgin Fiber Home Gateway HG1522 cross site scriptingEPSS 0.4%CVE-2024-28402MEDIUMTOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the FirewEPSS 0.4%CVE-2022-47053MEDIUMAn arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to exeEPSS 0.4%CVE-2024-6954MEDIUMSourceCodester Record Management System sort1.php cross site scriptingEPSS 0.4%CVE-2024-48461MEDIUMCross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the NewEPSS 0.4%CVE-2025-12716HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-58292MEDIUMXMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin TemplatesEPSS 0.4%CVE-2026-13114HIGHMotors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical InfoEPSS 0.4%