Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-4293MEDIUMKieback & Peter DDC Building Controllers Cross-site ScriptingEPSS 0.3%CVE-2025-27320MEDIUMWordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13846MEDIUMEasy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-0632MEDIUMAutomatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom FontEPSS 0.3%CVE-2024-3031MEDIUMFluid Notification Bar <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43156HIGHWordPress Post Grid Master plugin <= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4462MEDIUMNafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-105862HIGHPayload: Bypassed sanitization of user uploaded SVGsEPSS 0.3%CVE-2025-48252MEDIUMWordPress Back Button Widget plugin <= 1.6.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-13373MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration ConfigurationEPSS 0.3%CVE-2024-52351MEDIUMWordPress BU Slideshow plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49659MEDIUMWordPress Coub plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56035HIGHWordPress Upload Scanner plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8313MEDIUMCampus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterEPSS 0.3%CVE-2024-52353MEDIUMWordPress Christian Science Bible Lesson Subjects plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-58037NONECore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputEPSS 0.3%CVE-2024-56034HIGHWordPress Services updates for customers plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7646MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-4557MEDIUMcode-projects Exam Form Submission update_s1.php cross site scriptingEPSS 0.3%CVE-2025-67834MEDIUMPaessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter.EPSS 0.3%