Weaknesses of type CWE-79

30,193 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-18099HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2024-21897HIGHQTS, QuTS heroEPSS 0.3%CVE-2025-23767MEDIUMWordPress Marmoset Viewer plugin <= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9853MEDIUMID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-7590MEDIUMWordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10179MEDIUMSlickstream: Engagement and Conversions <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid ShortcodeEPSS 0.3%CVE-2026-27639HIGHMercator vulnerable to stored XSS via unescaped Blade directives in display templatesEPSS 0.3%CVE-2025-3097MEDIUMwp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-48914HIGHCOOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075EPSS 0.3%CVE-2024-47772MEDIUMCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in DiscourseEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-11905MEDIUMAnimated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-76475CRITICALCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting VulnerabilitiesEPSS 0.3%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.3%CVE-2024-12493MEDIUMFiles Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41354HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.phpEPSS 0.3%CVE-2024-46996MEDIUMbaserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts FeatureEPSS 0.3%CVE-2024-8734MEDIUMLucas String Replace <= 2.0.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-5611MEDIUMStratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-1679MEDIUMCross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject maliciEPSS 0.3%