Weaknesses of type CWE-79

30,260 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-113500HIGHLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationEPSS 0.3%CVE-2023-44753MEDIUMA stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTEPSS 0.3%CVE-2026-103875MEDIUMMedia Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination LinksEPSS 0.3%CVE-2026-112958MEDIUMApostropheCMS: Stored XSS via Unescaped Widget Style Attribute SerializationEPSS 0.3%CVE-2023-27609MEDIUMWordPress WP Roles at Registration plugin <= 0.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-54859MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2025-47053MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-10368MEDIUMMiczFlor RPi-Jukebox-RFID manageFilesFolders.php cross site scriptingEPSS 0.3%CVE-2026-63156MEDIUMOmnispace Agora Project < 26.10.0 Reflected XSS via visioUrl ParameterEPSS 0.3%CVE-2025-21603MEDIUMCross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product aEPSS 0.3%CVE-2024-38454MEDIUMExpressionEngine before 7.4.11 allows XSS.EPSS 0.3%CVE-2025-67850HIGHMoodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editorEPSS 0.3%CVE-2025-11332MEDIUMCmsEasy URL view.php cross site scriptingEPSS 0.3%CVE-2023-50822MEDIUMWordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-51900MEDIUMWordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13083MEDIUMPen-drive: pen-drive: stored xss via unescaped cluster data in html reportEPSS 0.3%CVE-2024-1219MEDIUMEasy Social Feed < 6.5.6 - Contributor+ Stored XSSEPSS 0.3%CVE-2025-10367MEDIUMMiczFlor RPi-Jukebox-RFID cardEdit.php cross site scriptingEPSS 0.3%CVE-2022-3025MEDIUMBitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRFEPSS 0.3%