Weaknesses of type CWE-79

30,199 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-33035MEDIUMUnauthenticated Reflected XSS via innerHTML in AVideoEPSS 0.3%CVE-2024-2001MEDIUMCross-Site Scripting vulnerability in Cockpit CMSEPSS 0.3%CVE-2025-1490MEDIUMSmart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus ParameterEPSS 0.3%CVE-2024-55635MEDIUMDrupal core - Critical - Cross Site Scripting - SA-CORE-2024-005EPSS 0.3%CVE-2023-52213HIGHWordPress Rate Star Review Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-28112MEDIUMCross site scripting on router page in Peering ManagerEPSS 0.3%CVE-2025-22759MEDIUMWordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0470MEDIUMForminator <= 1.38.2 - Reflected Cross-Site Scripting via Title ParameterEPSS 0.3%CVE-2025-20180MEDIUMCisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-54049HIGHSakai Conversations has a Stored XSS IssueEPSS 0.3%CVE-2024-22129MEDIUMCross-Site Scripting (XSS) vulnerability in SAP CompanionEPSS 0.3%CVE-2026-24746MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2025-7739HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2026-59794HIGHIn JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported dataEPSS 0.3%CVE-2025-14131MEDIUMWP Widget Changer <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2025-24727MEDIUMWordPress Contact Form to Email Plugin <= 1.3.52 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3885MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box ShortcodeEPSS 0.3%CVE-2025-2165MEDIUMSH Email Alert <= 1.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-32956MEDIUMWordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56916MEDIUMIn Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current vEPSS 0.3%