Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-57911MEDIUMWordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46505MEDIUMWordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-6415MEDIUMAdvanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON FieldEPSS 0.3%CVE-2025-57910MEDIUMWordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-26919MEDIUMWordPress Tainá plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37548MEDIUMWordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51305MEDIUMPHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, pluginEPSS 0.3%CVE-2025-55816MEDIUMHotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.EPSS 0.3%CVE-2026-34565CRITICALCI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-17577MEDIUMSSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' ParameterEPSS 0.3%CVE-2025-48368MEDIUMGroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript ExecutionEPSS 0.3%CVE-2026-1216HIGHRSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' ParameterEPSS 0.3%CVE-2024-48703MEDIUMPhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdaEPSS 0.3%CVE-2025-46480MEDIUMWordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-7644MEDIUMPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-65019MEDIUMAstro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpointEPSS 0.3%CVE-2022-41814LOWPotential XSS in history viewEPSS 0.3%CVE-2025-3760MEDIUMA stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, andEPSS 0.3%CVE-2026-103909MEDIUMCalculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field EquationEPSS 0.3%CVE-2024-12444MEDIUMWP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%