Weaknesses of type CWE-79

29,991 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-1210MEDIUMHappy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta FieldEPSS 0.4%CVE-2026-75831MEDIUMGrav before 2.0.15 Stored XSS via audio/video source URLEPSS 0.4%CVE-2024-47618MEDIUMSulu vulnerable to XSS via uploaded SVGEPSS 0.4%CVE-2023-26040MEDIUMDiscourse chat messages susceptible to Cross-site Scripting through chat excerptsEPSS 0.4%CVE-2023-28520MEDIUMIBM Planning Analytics Local cross-site scriptingEPSS 0.4%CVE-2026-94211MEDIUMHyve5 Leantime Project Dashboard show.blade.php cross site scriptingEPSS 0.4%CVE-2026-1304MEDIUMMembership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice SettingsEPSS 0.4%CVE-2025-3036MEDIUMyzk2356911358 StudentServlet-JSP Student Management cross site scriptingEPSS 0.4%CVE-2024-44919MEDIUMA cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2023-32711MEDIUMPersistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard ViewEPSS 0.4%CVE-2026-68900HIGHWekan: Stored XSS in HTML board exports through a card-title second parseEPSS 0.4%CVE-2025-10827MEDIUMPHPJabbers Restaurant Menu Maker preview.php cross site scriptingEPSS 0.4%CVE-2024-47819MEDIUMUmbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionEPSS 0.4%CVE-2024-4695MEDIUMMove Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2023-51318MEDIUMPHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.EPSS 0.4%CVE-2022-50941MEDIUMBootCommerce 3.2.1 Persistent Cross-Site Scripting via Order CheckoutEPSS 0.4%CVE-2022-50940MEDIUMKnap Advanced PHP Login 3.1.3 Persistent Cross-Site Scripting via Name ParameterEPSS 0.4%CVE-2026-54506HIGHVvveb: Stored XSS via sanitizeHTML() bypass in user profile bio fieldEPSS 0.4%CVE-2025-26153MEDIUMA Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messageEPSS 0.4%CVE-2026-42870MEDIUMWeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'EPSS 0.4%