Weaknesses of type CWE-79

29,613 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-85189HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0EPSS 0.4%CVE-2025-24530MEDIUMAn issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted tabEPSS 0.4%CVE-2023-23807MEDIUMWordPress MojoPlug Slide Panel Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-77996HIGHJoomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41EPSS 0.4%CVE-2023-5564MEDIUMCross-site Scripting (XSS) - Stored in froxlor/froxlorEPSS 0.4%CVE-2023-26457MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Content ServerEPSS 0.4%CVE-2026-60029MEDIUMJoomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1EPSS 0.4%CVE-2026-78071HIGHJoomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0EPSS 0.4%CVE-2026-60034CRITICALJoomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0EPSS 0.4%CVE-2026-14337MEDIUMPega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.4%CVE-2026-12948MEDIUMStored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-4618MEDIUMExclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member WidgetEPSS 0.4%CVE-2026-41723HIGHVMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)EPSS 0.4%CVE-2023-23852MEDIUMSAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriptiEPSS 0.4%CVE-2026-60028HIGHJoomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1EPSS 0.4%CVE-2023-31807MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2025-7840MEDIUMCampcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scriptingEPSS 0.4%CVE-2025-4075MEDIUMVMSMan login.php cross site scriptingEPSS 0.4%CVE-2024-4657CRITICALStrored XSS in Talent Software's BAP AutomationEPSS 0.4%CVE-2024-29376MEDIUMSylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.EPSS 0.4%