Weaknesses of type CWE-79

30,009 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2787MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML TagEPSS 0.3%CVE-2026-90528MEDIUMTDuckApp tduck-platform Form Write View index.vue cross site scriptingEPSS 0.3%CVE-2024-30429MEDIUMWordPress wp-forecast plugin <= 9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-16156MEDIUMSourceCodester Class and Exam Timetabling System forexam.php cross site scriptingEPSS 0.3%CVE-2026-82483MEDIUMcoppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scriptingEPSS 0.3%CVE-2024-30426MEDIUMWordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6415MEDIUMIngenico Estate Manager New Widget cross site scriptingEPSS 0.3%CVE-2026-90567MEDIUMquequnlong shiyi-blog Search index.vue highlightKeyword cross site scriptingEPSS 0.3%CVE-2026-90835MEDIUMmichaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scriptingEPSS 0.3%CVE-2024-52812MEDIUMLF Edge eKuiper has Stored XSS in Rules FunctionalityEPSS 0.3%CVE-2023-47162MEDIUMIBM Secure Proxy cross-site scriptingEPSS 0.3%CVE-2026-82622MEDIUMcode-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scriptingEPSS 0.3%CVE-2026-15296MEDIUMaffiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-19209MEDIUMSourceCodester Photo Share Website index.php home cross site scriptingEPSS 0.3%CVE-2026-90694MEDIUMSourceCodester Inventory Management System Customer Management customers_handler.php cross site scriptingEPSS 0.3%CVE-2024-8186MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-22751HIGHWordPress Partners Plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27087MEDIUMKirby cross-site scripting (XSS) in the link field "Custom" typeEPSS 0.3%CVE-2026-19230MEDIUMSourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scriptingEPSS 0.3%CVE-2026-19922MEDIUMcode-projects Online Shopping System checkout.php cross site scriptingEPSS 0.3%