Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-7129MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.3%CVE-2026-89244MEDIUMWWBN AVideo Reflected XSS via Gallery Category getBackURLEPSS 0.3%CVE-2024-56262MEDIUMWordPress GS Coaches plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31595MEDIUMWordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-110224MEDIUMQloApps through 1.7.0 Reflected XSS via Search Alias Validation ErrorsEPSS 0.3%CVE-2025-47630MEDIUMWordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-96739MEDIUMSEMCMS KindEditor Upload upload_json.php cross site scriptingEPSS 0.3%CVE-2024-3998MEDIUMBetheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-30342MEDIUMAn XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is EPSS 0.3%CVE-2024-2784MEDIUMThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover CardEPSS 0.3%CVE-2025-22642MEDIUMWordPress Dynamic Conditions plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51769MEDIUMFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.EPSS 0.3%CVE-2024-2254MEDIUMRT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site ScriptingEPSS 0.3%CVE-2024-5263MEDIUMElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table WidgetsEPSS 0.3%CVE-2026-54720MEDIUMSilverstripe Framework: Possible XSS attack through media embedEPSS 0.3%CVE-2024-5330MEDIUMBreakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-113661MEDIUMApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsEPSS 0.3%CVE-2024-43915MEDIUMWordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56245MEDIUMWordPress Premium Blocks plugin <= 2.1.42 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31562MEDIUMWordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%