Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-1705MEDIUMD-Link DSL-6641K Web ad_virtual_server_vdsl cross site scriptingEPSS 0.3%CVE-2025-23725HIGHWordPress Accessibility Task Manager plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100172HIGHStored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributesEPSS 0.3%CVE-2025-22569HIGHWordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23733HIGHWordPress SC Simple Zazzle plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22709HIGHWordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22353HIGHWordPress BVD Easy Gallery Manager plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7392MEDIUMCookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087EPSS 0.3%CVE-2025-43802MEDIUMStored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.EPSS 0.3%CVE-2024-51946MEDIUMStored XSS in Rest Services Directory under Identify operationEPSS 0.3%CVE-2019-25394MEDIUMSmoothwall Express 3.1 'modem.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2025-22593HIGHWordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2025-24626HIGHWordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51924MEDIUMWordPress WP Agenda plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3170MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scriptingEPSS 0.3%CVE-2025-46484MEDIUMWordPress Image Hover Effects For WPBakery Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-51953MEDIUMStored XSS in ArcGIS Server Rest servicesEPSS 0.3%CVE-2026-73336MEDIUMJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2EPSS 0.3%CVE-2025-22706HIGHWordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-36605MEDIUMDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulEPSS 0.3%