Weaknesses of type CWE-79

30,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-33978MEDIUMNotesnook: Stored XSS in mobile share editor via unescaped web clip title metadataEPSS 0.3%CVE-2025-13676MEDIUMJustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELFEPSS 0.3%CVE-2025-22758MEDIUMWordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-62183MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.EPSS 0.3%CVE-2022-3895MEDIUMPotential XSS in common user interface component libraryEPSS 0.3%CVE-2026-47324MEDIUMStored XSS in Multiple Points in ProjectsAndPrograms school-management-systemEPSS 0.3%CVE-2025-11804MEDIUMJB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24542MEDIUMWordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-6427MEDIUMa3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ElementEPSS 0.3%CVE-2025-10194MEDIUMShortcode Button <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-47527MEDIUMWordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-39124MEDIUMIn Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.EPSS 0.3%CVE-2025-22329MEDIUMWordPress Free Google Maps plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25392MEDIUMSmoothwall Express 3.1 'iptools.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2025-0448MEDIUMInappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a cEPSS 0.3%CVE-2015-20114MEDIUMRealtyScript 4.0.2 Cross-Site Scripting via Multiple ParametersEPSS 0.3%CVE-2026-105972HIGHWooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation AttributeEPSS 0.3%CVE-2024-3492MEDIUMEvents Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category ShortcodesEPSS 0.3%CVE-2026-5625MEDIUMassafelovic gpt-researcher WebSocket researcher.py cross site scriptingEPSS 0.3%CVE-2024-54123MEDIUMBackdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.EPSS 0.3%