Weaknesses of type CWE-79

29,695 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-71445HIGHAuthenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-frameworkEPSS 0.4%CVE-2023-32580MEDIUMWordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-40729MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Customer Support SystemEPSS 0.4%CVE-2026-25648HIGHTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File UploadEPSS 0.4%CVE-2023-32505MEDIUMWordPress Easy Hide Login Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-3388MEDIUMhailey888 oa_system Frontend LoginsController.java loginCheck cross site scriptingEPSS 0.4%CVE-2026-91204MEDIUMApache Roller: Stored javascript: URI in HTML commentsEPSS 0.4%CVE-2023-47549MEDIUMWordPress EazyDocs Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2021-46678MEDIUMVulnerability XSS in service form name fieldEPSS 0.4%CVE-2025-12510HIGHWidgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google ReviewsEPSS 0.4%CVE-2023-24385MEDIUMWordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32515MEDIUMWordPress Custom Field Suite Plugin <= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-27902MEDIUMSvelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersEPSS 0.4%CVE-2023-33211MEDIUMWordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29413MEDIUMCross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in theEPSS 0.4%CVE-2026-73161MEDIUMcti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingEPSS 0.4%CVE-2026-34491MEDIUMImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and JohnsoEPSS 0.4%CVE-2023-25042MEDIUMWordPress oAuth Twitter Feed for Developers Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-94277MEDIUMStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameEPSS 0.4%CVE-2021-46679MEDIUMVulnerability XSS in service elementsEPSS 0.4%