Weaknesses of type CWE-79

30,302 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13590MEDIUMKetchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5221MEDIUMQi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-13183HIGHStored XSS in Hotech's OtelloEPSS 0.3%CVE-2026-53578CRITICALTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtmlEPSS 0.3%CVE-2026-1093MEDIUMWPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-49423HIGHWordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0913MEDIUMUser Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' ShortcodeEPSS 0.3%CVE-2025-68866HIGHWordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68518HIGHWordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31914MEDIUMIBM Sterling B2B Integrator cross-site scriptingEPSS 0.3%CVE-2025-37122MEDIUMUnauthenticated Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-0694MEDIUMSearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2025-28956HIGHWordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39478HIGHWordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-104727MEDIUMSequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array KeysEPSS 0.3%CVE-2025-25173HIGHWordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-48996CRITICALTrilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop clientEPSS 0.3%CVE-2024-5414HIGHCross-Site Scripting (XSS) vulnerability on PhpMyBackupProEPSS 0.3%CVE-2025-8428MEDIUMXSS found in the HTTP loader widgetEPSS 0.3%CVE-2025-47574HIGHWordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%