Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-13910MEDIUMWP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37936MEDIUMWordPress Tabs For WPBakery Page Builder plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-59982MEDIUMJunos Space: Dashboard Search field is vulnerable to reflected cross-site script injectionEPSS 0.3%CVE-2024-49263MEDIUMWordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49137HIGHHax CMS Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2026-17019MEDIUMJetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)EPSS 0.3%CVE-2026-25789HIGHAffected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social EPSS 0.3%CVE-2025-59981MEDIUMJunos Space: Device Template Definition page is vulnerable to reflected cross-site script injectionEPSS 0.3%CVE-2025-13383MEDIUMJob Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array StorageEPSS 0.3%CVE-2025-22308MEDIUMWordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47299MEDIUMWordPress Website Builder by SeedProd <= 6.17.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44024MEDIUMWordPress Medical Addon for Elementor plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47638MEDIUMWordPress WP Discord Invite plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50431MEDIUMWordPress Breeze plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44022MEDIUMWordPress Review & testimonial widgets plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-15383MEDIUMBlog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent HeaderEPSS 0.3%CVE-2026-11588MEDIUMEONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post CreationEPSS 0.3%CVE-2026-1043MEDIUMPostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2024-38738MEDIUMWordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-33673HIGHPrestaShop has multiple stored XSS vulnerabilities via unprotected Template variablesEPSS 0.3%