Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-5721MEDIUMwpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 - Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data ImportEPSS 0.3%CVE-2015-4582HIGHThe TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not EPSS 0.3%CVE-2024-5869MEDIUMNeighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeEPSS 0.3%CVE-2025-7059MEDIUMSimple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow ParameterEPSS 0.3%CVE-2024-37206HIGHWordPress Demo Awesome plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-36085MEDIUMStored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers EPSS 0.3%CVE-2025-14891MEDIUMCustomer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName ParameterEPSS 0.3%CVE-2026-102342MEDIUMammonia allows stored XSS through unsanitized SVG animate and set attributesEPSS 0.3%CVE-2024-36392MEDIUMMileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-0914MEDIUMWP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' ShortcodeEPSS 0.3%CVE-2025-13463MEDIUMBold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post GridEPSS 0.3%CVE-2024-40074MEDIUMSourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSetEPSS 0.3%CVE-2025-14851MEDIUMYaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ParametersEPSS 0.3%CVE-2025-22649MEDIUMWordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-48023HIGHWordPress Restaurant Reservations Widget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-96531MEDIUMOptimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player BlockEPSS 0.3%CVE-2025-28930MEDIUMWordPress List Mixcloud plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14144MEDIUMMstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode AttributeEPSS 0.3%CVE-2024-53281MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology EPSS 0.3%CVE-2026-41580MEDIUMStirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)EPSS 0.3%