Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-25095MEDIUMWordPress ReverbNation Widgets plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability<EPSS 0.3%CVE-2024-12120MEDIUMRoyal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26891MEDIUMWordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42671MEDIUMA Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicioEPSS 0.3%CVE-2025-6201MEDIUMPixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-45892MEDIUMOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because iEPSS 0.3%CVE-2025-5700MEDIUMSimple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-37350MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2025-15452MEDIUMxnx3 wangmarket Backend Variable Search variableList.do variableList cross site scriptingEPSS 0.3%CVE-2025-5589MEDIUMStreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text ParameterEPSS 0.3%CVE-2024-44573MEDIUMA stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbiEPSS 0.3%CVE-2024-10000MEDIUMMasteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question FunctionalityEPSS 0.3%CVE-2025-25076MEDIUMWordPress Graceful Email Obfuscation plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4439HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2026-3982MEDIUMitsourcecode University Management System view_result.php cross site scriptingEPSS 0.3%CVE-2025-31855MEDIUMWordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67943HIGHWordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13867MEDIUMListivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-1513HIGHPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46469MEDIUMWordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%