Weaknesses of type CWE-79

30,100 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-1654MEDIUMPeter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2024-27966MEDIUMWordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6613MEDIUMPHPGurukul Hospital Management System manage-patient.php cross site scriptingEPSS 0.3%CVE-2026-59710MEDIUMshowdown - Stored XSS via Unescaped Table Header ID Attribute InjectionEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%CVE-2023-32790MEDIUMXSS on NXLog Manager EPSS 0.3%CVE-2024-33693MEDIUMWordPress Meks Smart Social Widget plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33694MEDIUMWordPress Meks ThemeForest Smart Widget plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-54714MEDIUMLogto: XSS via unescaped RelayState in SAML auto-submit formEPSS 0.3%CVE-2024-32591MEDIUMWordPress Backend Designer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-0858MEDIUMVersions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of iEPSS 0.3%CVE-2024-33940MEDIUMWordPress EventON plugin <= 2.2.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1114MEDIUMnewbee-mall Add Category Page save cross site scriptingEPSS 0.3%CVE-2024-33697MEDIUMWordPress CF7 File Download plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34574MEDIUMWordPress Table Maker plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-64392MEDIUMThis vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craftEPSS 0.3%CVE-2026-69116MEDIUMFlyEnv < 4.18.0 Cross-Site Scripting via v-htmlEPSS 0.3%CVE-2026-88976MEDIUM@platejs/core HTML deserialization can trigger browser behavior during parsingEPSS 0.3%