Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22771MEDIUMWordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2685MEDIUMTablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26870MEDIUMWordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4846MEDIUMdameng100 muucmf autoReply.html cross site scriptingEPSS 0.3%CVE-2025-48920HIGHetracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074EPSS 0.3%CVE-2026-58391MEDIUMOPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutEPSS 0.3%CVE-2024-1399MEDIUMRestaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-26749MEDIUMWordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34566CRITICALCI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2025-61674MEDIUMOctober CMS Vulnerable to Stored XSS via Editor and Branding StylesEPSS 0.3%CVE-2025-15055HIGHSlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' ParametersEPSS 0.3%CVE-2026-5247MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode AttributeEPSS 0.3%CVE-2024-43130MEDIUMWordPress Football Pool plugin <= 2.11.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22340MEDIUMWordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0054MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-69296HIGHWordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50412MEDIUMWordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5015MEDIUMelecV2 elecV2P Endpoint logs cross site scriptingEPSS 0.3%CVE-2024-37545MEDIUMWordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68843HIGHWordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%