Weaknesses of type CWE-79

29,827 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-26991MEDIUMLibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups nameEPSS 0.4%CVE-2024-53620MEDIUMA cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scriEPSS 0.4%CVE-2024-6035HIGHStored XSS in gaizhenbiao/chuanhuchatgptEPSS 0.4%CVE-2026-26992MEDIUMLibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups nameEPSS 0.4%CVE-2026-4120MEDIUMInfo Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2024-8770MEDIUMA Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attacEPSS 0.4%CVE-2024-4617MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-4083MEDIUMScoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%CVE-2024-32694HIGHWordPress 3D FlipBook, PDF Viewer, PDF Embedder plugin <= 3.62 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-1957MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-9028MEDIUMWP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx ShortcodeEPSS 0.4%CVE-2024-1590MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.4%CVE-2025-15454LOWzhanglun lettura RSS ContentRender.tsx cross site scriptingEPSS 0.4%CVE-2023-22594MEDIUMIBM Robotic Process Automation for Cloud Pak cross-site scriptingEPSS 0.4%CVE-2024-1761MEDIUMWP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2024-7269HIGHStored XSS in ConnX ESP HR ManagementEPSS 0.4%CVE-2022-43914MEDIUMIBM TRIRIGA Application Platform cross-site scriptingEPSS 0.4%CVE-2023-26059MEDIUMAn issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when prEPSS 0.4%CVE-2023-40684MEDIUMIBM Content Navigator cross-site scriptingEPSS 0.4%CVE-2023-35905MEDIUMIBM FileNet Content Manager cross-site scriptingEPSS 0.4%