Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-7113MEDIUMPortabilis i-Educar Curricular Components Module edit cross site scriptingEPSS 0.3%CVE-2025-23669MEDIUMWordPress WP Smart Tooltip plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9952MEDIUMTrinity Audio <= 5.20.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-50464MEDIUMWordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30625MEDIUMWordPress AppBanners plugin <= 1.5.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-16032MEDIUMLWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User MonitoringEPSS 0.3%CVE-2025-56762MEDIUMParacrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.EPSS 0.3%CVE-2025-30937MEDIUMWordPress Responsify WP plugin <= 1.9.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47595MEDIUMWordPress Color Your Bar plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-30630MEDIUMWordPress Global Translator plugin <= 2.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-51506MEDIUMWordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-47622MEDIUMWordPress Email Notification on Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14845MEDIUMNewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post WidgetEPSS 0.3%CVE-2026-14592MEDIUMWP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addrEPSS 0.3%CVE-2025-23055MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management InterfaceEPSS 0.3%CVE-2024-47647MEDIUMWordPress FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin plugin <= 1.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-23880HIGHOnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take OverEPSS 0.3%CVE-2025-25939MEDIUMReprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.EPSS 0.3%CVE-2024-47336MEDIUMWordPress Terms Descriptions plugin <= 3.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-41021MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Sergestec's ExitoEPSS 0.3%