Weaknesses of type CWE-79

29,879 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3962MEDIUMJcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scriptingEPSS 0.4%CVE-2025-10386MEDIUMYida ECMS Consulting Enterprise Management System POST Request login.do cross site scriptingEPSS 0.4%CVE-2025-23642MEDIUMWordPress Sidebar-Content from Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-74999MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.EPSS 0.4%CVE-2023-31079MEDIUMWordPress Tippy Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23701MEDIUMWordPress Easy Sign Up Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23699MEDIUMWordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41248MEDIUMIn JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configurationEPSS 0.4%CVE-2023-32239MEDIUMWordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23709MEDIUMWordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28773MEDIUMWordPress Secondary Title Plugin <= 2.0.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23664MEDIUMWordPress ConvertBox Auto Embed WordPress plugin Plugin <= 1.0.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-38516MEDIUMWordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-11598MEDIUMShortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode AttributeEPSS 0.4%CVE-2023-22696MEDIUMWordPress Affiliate Links Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-27570MEDIUMDiscourse Vulnerable to Stored XSS via Shared AI Conversation OneboxEPSS 0.4%CVE-2023-23667MEDIUMWordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-87762HIGHAdwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type JugglingEPSS 0.4%CVE-2023-40197MEDIUMWordPress flowpaper Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5088MEDIUMHappy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%