Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-47524MEDIUMWordPress Quran multilanguage Text & Audio plugin <= 2.3.23 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-0152MEDIUMIBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-26989MEDIUMLibreNMS has Stored XSS in Alert RuleEPSS 0.3%CVE-2026-14190MEDIUMSina Extension for Elementor < 3.10.2 - Reflected XSSEPSS 0.3%CVE-2025-7109MEDIUMPortabilis i-Educar Student Benefits Registration educar_aluno_beneficio_lst.php cross site scriptingEPSS 0.3%CVE-2025-30941MEDIUMWordPress Pinterest Verify Meta Tag plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-47372MEDIUMWordPress TNC PDF viewer plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51928MEDIUMWordPress Blocks Post Grid plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-15032MEDIUMwpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL ConversionEPSS 0.3%CVE-2024-44040MEDIUMWordPress ShiftController Employee Shift Scheduling plugin <= 4.9.64 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47592MEDIUMWordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin <= 2.0.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-49322MEDIUMWordPress 404 Page by SeedProd < 1.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-39910MEDIUMCross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editorEPSS 0.3%CVE-2026-11434MEDIUMFluentCMS Blocks Plugin blocks cross site scriptingEPSS 0.3%CVE-2026-1910MEDIUMUpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' AttributeEPSS 0.3%CVE-2024-49277MEDIUMWordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37565MEDIUMWordPress Gum Elementor Addon plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47607MEDIUMWordPress Show All Comments plugin <= 7.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-1450MEDIUMFloating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-26000MEDIUMWordPress Bang tinh vay <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%