Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22324HIGHWordPress OZ Canonical plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22326HIGHWordPress 5centsCDN plugin <= 25.4.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46447MEDIUMWordPress Fable Extra plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-51531MEDIUMA reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript inEPSS 0.3%CVE-2025-22567HIGHWordPress TRUSTist REVIEWer Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22506HIGHWordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2025-23727HIGHWordPress AZ Content Finder plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22711HIGHWordPress Image Source Control Lite Plugin <= 2.29.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46476MEDIUMWordPress Awesome Wp Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-23544HIGHWordPress StatPressCN plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51923MEDIUMWordPress Websand Subscription Form plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22588HIGHWordPress Scanventory Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5083MEDIUMAmministrazione Trasparente <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r FunctionEPSS 0.3%CVE-2026-79627HIGHAdvanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff BypassEPSS 0.3%CVE-2026-8626MEDIUMSponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF ParameterEPSS 0.3%CVE-2025-60958HIGHCross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attacEPSS 0.3%CVE-2025-20208MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attaEPSS 0.3%CVE-2026-92224MEDIUMJoomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3EPSS 0.3%CVE-2024-51927MEDIUMWordPress Rig Elements For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13513MEDIUMClik stats <= 0.8 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%