Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-5970MEDIUMMaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb ShortcodeEPSS 0.3%CVE-2025-45662MEDIUMA cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitEPSS 0.3%CVE-2024-12119MEDIUMFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title SizeEPSS 0.3%CVE-2025-26930MEDIUMWordPress Home Services plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46501MEDIUMWordPress Mixcloud Embed plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46461MEDIUMWordPress RRSSB plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-4849MEDIUMWordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay ParameterEPSS 0.3%CVE-2025-26950MEDIUMWordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5533MEDIUMbadlogic pi-mono SVG Artifact SvgArtifact.ts cross site scriptingEPSS 0.3%CVE-2024-47377MEDIUMWordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26880MEDIUMWordPress SKT Skill Bar plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12451MEDIUMHTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46491MEDIUMWordPress Multi-Column Taxonomy List plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46467MEDIUMWordPress RAphicon plugin <= 2.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-22268MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1757MEDIUMWordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-26934MEDIUMWordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27567MEDIUMCross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerabiEPSS 0.3%CVE-2024-43148MEDIUMWordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69368HIGHWordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%