Weaknesses of type CWE-79

30,294 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-39311MEDIUMTrilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG AttachmentsEPSS 0.3%CVE-2024-37509HIGHWordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31414MEDIUMThe Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feEPSS 0.3%CVE-2025-23111MEDIUMAn issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing EPSS 0.3%CVE-2024-32587MEDIUMWordPress EnvíaloSimple plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35730HIGHWordPress Active Products Tables for WooCommerce plugin <= 1.0.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25397MEDIUMIPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgiEPSS 0.3%CVE-2024-49641HIGHWordPress Tida URL Screenshot plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45451MEDIUMWordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32547MEDIUMWordPress Code Insert Manager (Q2W3 Inc Manager) plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49645HIGHWordPress Affiliate Platform plugin <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18243MEDIUMHP DesignJet T3500 - Potential Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-59671MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2024-41707MEDIUMAn issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated EPSS 0.3%CVE-2026-30587MEDIUMMultiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,EPSS 0.3%CVE-2024-49323HIGHWordPress All in One Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35668HIGHWordPress Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin <= 3.1.77 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4085MEDIUMEasy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode AttributeEPSS 0.3%CVE-2025-26884MEDIUMWordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12282MEDIUMcode-projects Client Details System manage-users.php cross site scriptingEPSS 0.3%