Weaknesses of type CWE-79

29,650 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3659MEDIUMWP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.4%CVE-2025-32132MEDIUMWordPress FunnelCockpit Plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-25041HIGHWordPress Monolit Theme <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-32135MEDIUMWordPress Split Test For Elementor plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-11903HIGHStored XSS in MOVEit Transfer Ad Hoc moduleEPSS 0.4%CVE-2024-36417MEDIUMSuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrameEPSS 0.4%CVE-2024-20298MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-20269MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-2149MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scriptingEPSS 0.4%CVE-2024-20264MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-2159MEDIUMSourceCodester Simple Responsive Tourism Website Registration Master.php cross site scriptingEPSS 0.4%CVE-2024-42055MEDIUMCervantes through 0.5-alpha allows stored XSS.EPSS 0.4%CVE-2024-56377MEDIUMA stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts iEPSS 0.4%CVE-2026-67352MEDIUMluci-app-https-dns-proxy Stored XSS via resolver_urlEPSS 0.4%CVE-2024-20300MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-48768CRITICALTypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileNameEPSS 0.4%CVE-2025-24018HIGHYesWiki Vulnerable to Authenticated Stored XSSEPSS 0.4%CVE-2024-42020HIGHA Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.EPSS 0.4%CVE-2024-7427MEDIUMPotential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi).EPSS 0.4%CVE-2024-8656MEDIUMWPFactory Helper <= 1.7.0 - Reflected Cross-Site ScriptingEPSS 0.4%