Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-47518MEDIUMWordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-47343MEDIUMWordPress Mega Elements – Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47516MEDIUMWordPress Time Clock plugin <= 1.2.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-11371MEDIUMBetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt InjectionEPSS 0.3%CVE-2025-2330MEDIUMAll-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal WidgetEPSS 0.3%CVE-2026-1647MEDIUMComment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2026-109972MEDIUMs2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode AttributeEPSS 0.3%CVE-2025-25017HIGHKibana Stored Cross-Site Scripting (XSS)EPSS 0.3%CVE-2025-44184MEDIUMSourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the website_image,EPSS 0.3%CVE-2024-47342MEDIUMWordPress Accordion plugin <= 2.2.99 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47615MEDIUMWordPress Amazon Product in a Post plugin <= 5.2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-69229MEDIUMHTML injection vulnerability in Esri Portal for ArcGISEPSS 0.3%CVE-2025-30977MEDIUMWordPress Chaport <= 1.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-50432MEDIUMWordPress Post Grid and Gutenberg Blocks plugin <= 2.2.93 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37919MEDIUMWordPress Timeline Module for Beaver Builder plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-61886MEDIUMAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForEPSS 0.3%CVE-2026-1037MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.3%CVE-2025-12117MEDIUMRenden <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2025-30634MEDIUMWordPress WP Featured Content Slider plugin <= 2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47521MEDIUMWordPress Robo Gallery plugin <= 5.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%