Weaknesses of type CWE-79

29,656 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%CVE-2023-5892MEDIUMCross-site Scripting (XSS) - Stored in pkp/pkp-libEPSS 0.4%CVE-2024-3267MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list ShortcodeEPSS 0.4%CVE-2026-41240MEDIUMDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)EPSS 0.4%CVE-2024-13141MEDIUMosuuu LightPicture SVG File Upload upload cross site scriptingEPSS 0.4%CVE-2026-54087HIGHEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldEPSS 0.4%CVE-2025-4054MEDIUMRelevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search HighlightsEPSS 0.4%CVE-2025-0175MEDIUMcode-projects Online Shop view.php cross site scriptingEPSS 0.4%CVE-2023-30496HIGHWordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12783MEDIUMitsourcecode Vehicle Management System billaction.php cross site scriptingEPSS 0.4%CVE-2024-41805MEDIUMTracks vulnerable to reflected cross-site scriptingEPSS 0.4%CVE-2023-5891MEDIUMCross-site Scripting (XSS) - Reflected in pkp/pkp-libEPSS 0.4%CVE-2024-33424MEDIUMA cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML EPSS 0.4%CVE-2024-33539MEDIUMWordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-29771MEDIUMHtmlSanitizer vulnerable to XSS when used with contentEditableEPSS 0.4%CVE-2026-103904HIGHStored XSS Vulnerability in JTL-ShopEPSS 0.4%CVE-2024-1357MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' ShortcodeEPSS 0.4%CVE-2026-19760HIGHWP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host HeaderEPSS 0.4%CVE-2025-22338HIGHWordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-50126MEDIUMExtension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for JoomlaEPSS 0.4%