Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-45893MEDIUMOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerabilEPSS 0.3%CVE-2025-31818MEDIUMWordPress ContentBot AI Writer plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5237MEDIUMTarget Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width ParameterEPSS 0.3%CVE-2025-32199MEDIUMWordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36043MEDIUMquestion_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.EPSS 0.3%CVE-2025-68849HIGHWordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1853MEDIUMBuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode AttributeEPSS 0.3%CVE-2025-39427MEDIUMWordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31860MEDIUMWordPress WP AdCenter plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7050HIGHUse-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File MetadataEPSS 0.3%CVE-2025-26980MEDIUMWordPress Wired Impact Volunteer Management plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25085MEDIUMWordPress WP SimpleWeather plugin <= 0.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-33916MEDIUMHandlebars.js has Prototype Pollution Leading to XSS through Partial Template InjectionEPSS 0.3%CVE-2025-13989MEDIUMWP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode AttributeEPSS 0.3%CVE-2024-3814MEDIUMtagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaEPSS 0.3%CVE-2025-49947HIGHWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46440HIGHWordPress kStats Reloaded plugin <= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46515HIGHWordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35653MEDIUMWordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4473MEDIUMSydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio WidgetEPSS 0.3%