Weaknesses of type CWE-79

29,826 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.4%CVE-2023-1841HIGHHoneywell MPA2 Web Application XSS vulnerabilityEPSS 0.4%CVE-2023-26061MEDIUMAn issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can creaEPSS 0.4%CVE-2024-4635MEDIUMMenu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2024-3575MEDIUMCross-site Scripting (XSS) - Stored in mindsdb/mindsdbEPSS 0.4%CVE-2026-27505MEDIUMSVXportal <= 2.5 admin/user_action.php Stored XSSEPSS 0.4%CVE-2022-43866MEDIUMIBM Maximo Asset Management cross-site scriptingEPSS 0.4%CVE-2026-3516MEDIUMContact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' ParameterEPSS 0.4%CVE-2026-35576HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpEPSS 0.4%CVE-2023-38722MEDIUMIBM Sterling Partner Engagement Manager cross-site scriptingEPSS 0.4%CVE-2024-53620MEDIUMA cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scriEPSS 0.4%CVE-2026-4120MEDIUMInfo Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2024-8770MEDIUMA Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attacEPSS 0.4%CVE-2024-12843MEDIUMEmlog Pro plugin.php cross site scriptingEPSS 0.4%CVE-2026-28426HIGHStatamic vulnerable to privilege escalation via stored cross-site scriptingEPSS 0.4%CVE-2026-26991MEDIUMLibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups nameEPSS 0.4%CVE-2026-4075MEDIUMBWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode AttributeEPSS 0.4%CVE-2023-24957MEDIUMIBM Business Automation Workflow cross-site scriptingEPSS 0.4%CVE-2024-6035HIGHStored XSS in gaizhenbiao/chuanhuchatgptEPSS 0.4%CVE-2023-26274MEDIUMIBM QRadar cross-site scriptingEPSS 0.4%