Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-5231HIGHWP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' ParameterEPSS 0.4%CVE-2022-48007MEDIUMA stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2026-97783HIGHMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2026-6431HIGHUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta FieldEPSS 0.4%CVE-2026-9107MEDIUMKali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' ParameterEPSS 0.4%CVE-2021-34181MEDIUMCross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.EPSS 0.4%CVE-2024-13197MEDIUMdonglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scriptingEPSS 0.4%CVE-2022-40968MEDIUMWordPress 2kb Amazon Affiliates Store Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-13192MEDIUMZeroWdd myblog BlogController.java update cross site scriptingEPSS 0.4%CVE-2022-41315MEDIUMWordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-11780MEDIUMQuiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' ParameterEPSS 0.4%CVE-2026-4658MEDIUMGutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2026-13246MEDIUMGiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode AttributeEPSS 0.4%CVE-2024-1572MEDIUMWP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-2752MEDIUMWhere Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-16597HIGHGTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing FieldsEPSS 0.4%CVE-2026-15002HIGHAutopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' ParameterEPSS 0.4%CVE-2026-15052HIGHMailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field ValuesEPSS 0.4%CVE-2026-85414MEDIUMGallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode AttributeEPSS 0.4%CVE-2026-21264CRITICALMicrosoft Account Spoofing VulnerabilityEPSS 0.4%