Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-58643MEDIUMWindows Admin Center Spoofing VulnerabilityEPSS 0.4%CVE-2024-5083MEDIUMNexus Repository 2 - Stored XSSEPSS 0.4%CVE-2024-3558MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]EPSS 0.4%CVE-2025-56526MEDIUMCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.EPSS 0.4%CVE-2024-9239MEDIUMBooster for WooCommerce <= 7.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12182MEDIUMDedeCMS soft_add.php cross site scriptingEPSS 0.4%CVE-2019-25419MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via scheduleEPSS 0.4%CVE-2026-92136HIGHJenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultinEPSS 0.4%CVE-2026-92134HIGHJenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitteEPSS 0.4%CVE-2025-8668CRITICALReflected XSS in E-Kalite Software Hardware Engineering's TurboardEPSS 0.4%CVE-2023-49485MEDIUMJFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.EPSS 0.4%CVE-2026-92135HIGHJenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thrEPSS 0.4%CVE-2024-27757MEDIUMflusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development asEPSS 0.4%CVE-2026-56698MEDIUMNuxt - Cross-Site Scripting via navigateTo open OptionEPSS 0.4%CVE-2021-39161MEDIUMCross-site scripting via category name in DiscourseEPSS 0.4%CVE-2026-4811MEDIUMWPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category FieldEPSS 0.4%CVE-2026-36748CRITICALRockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.EPSS 0.4%CVE-2024-12181MEDIUMDedeCMS SWF File uploads_add.php cross site scriptingEPSS 0.4%CVE-2023-6556MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-45500MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.4%