Weaknesses of type CWE-79

30,235 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3043MEDIUMitsourcecode Event Management System navbar.php cross site scriptingEPSS 0.3%CVE-2026-57530MEDIUMMilkdown < 7.21.3 Stored XSS via javascript: URL in link hrefEPSS 0.3%CVE-2026-2943MEDIUMSapneshNaik Student Management System index.php cross site scriptingEPSS 0.3%CVE-2024-56357HIGHCross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-coreEPSS 0.3%CVE-2025-22596MEDIUMWeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos_visiveis.php' parameter'msg_c'EPSS 0.3%CVE-2023-53906MEDIUMProjectSend r1605 Stored Cross-Site Scripting via Custom Assets PageEPSS 0.3%CVE-2026-0549MEDIUMGroups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' ShortcodeEPSS 0.3%CVE-2026-18872CRITICALIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-8750MEDIUMmacrozheng mall Add Product Page upload cross site scriptingEPSS 0.3%CVE-2024-21984MEDIUMReflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)EPSS 0.3%CVE-2024-5571MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF WidgetEPSS 0.3%CVE-2025-68497MEDIUMWordPress Astra Widgets plugin <= 1.2.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10269MEDIUMEasy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-54181MEDIUMbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedEPSS 0.3%CVE-2026-63354CRITICALAffected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the TEPSS 0.3%CVE-2025-54476MEDIUMJoomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter codeEPSS 0.3%CVE-2026-10087HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-68037HIGHWordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5161MEDIUMMagical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-32597MEDIUMWordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%