Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-76324MEDIUMStored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk EnterpriseEPSS 0.3%CVE-2026-81731MEDIUMFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link DescriptionEPSS 0.3%CVE-2026-34989CRITICALCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-41722HIGHVMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)EPSS 0.3%CVE-2024-12852MEDIUMHappy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2352MEDIUMStarSea99 starsea-mall Backend save cross site scriptingEPSS 0.3%CVE-2024-36994MEDIUMPersistent Cross-site Scripting (XSS) in Dashboard ElementsEPSS 0.3%CVE-2024-38493MEDIUMSymantec Privileged Access Manager Reflected Cross Site Scripting vulnerabilityEPSS 0.3%CVE-2025-11857MEDIUMXX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-39656HIGHWordPress Tin Canny Reporting for LearnDash plugin <= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22444MEDIUMA vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflEPSS 0.3%CVE-2026-96669HIGHFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' CookieEPSS 0.3%CVE-2026-10618MEDIUMHugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute ValuesEPSS 0.3%CVE-2026-109266MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP EncoderEPSS 0.3%CVE-2026-3618MEDIUMColumns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' AttributeEPSS 0.3%CVE-2026-50709MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingEPSS 0.3%CVE-2026-6184MEDIUMcode-projects Simple Content Management System welcome.php cross site scriptingEPSS 0.3%CVE-2025-48234MEDIUMWordPress Ultimate Blocks plugin <= 3.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-1891LOWStored Cross Site ScriptingEPSS 0.3%CVE-2024-12524MEDIUMClinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%