Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-67947HIGHWordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3993MEDIUMitsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingEPSS 0.3%CVE-2025-68012HIGHWordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31091MEDIUMWordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-33533MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has bEPSS 0.3%CVE-2024-52354MEDIUMWordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6257MEDIUMEuro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency ShortcodeEPSS 0.3%CVE-2025-25078MEDIUMWordPress Google Earth Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5923MEDIUMGame Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-52358MEDIUMWordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-36956MEDIUMOpenfire 4.6.0 - 'path' Stored XSSEPSS 0.3%CVE-2025-15372MEDIUMyoulaitech vue3-element-admin Notice index.vue cross site scriptingEPSS 0.3%CVE-2025-46459MEDIUMWordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-25098MEDIUMWordPress Links in Captions plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31622MEDIUMWordPress Advanced Typekit plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25097MEDIUMWordPress External "Video for Everybody" plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49046HIGHWordPress xPromoter plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25094MEDIUMWordPress Breaking News Ticker plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-29686MEDIUMA cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a cEPSS 0.3%CVE-2025-26878MEDIUMWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%