Weaknesses of type CWE-79

30,302 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-21572MEDIUMOpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handliEPSS 0.3%CVE-2026-0916MEDIUMRelated Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' ShortcodeEPSS 0.3%CVE-2025-69343MEDIUMWordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69321HIGHWordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50969MEDIUMuBidAuction 2.0.1 mailingLog manage Reflected XSSEPSS 0.3%CVE-2025-31500HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.EPSS 0.3%CVE-2022-50967MEDIUMuBidAuction 2.0.1 tickets manage Reflected XSSEPSS 0.3%CVE-2025-69102HIGHWordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53579CRITICALTrilium: Note Import to RCE via Book NoteEPSS 0.3%CVE-2024-1161MEDIUMBrizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesEPSS 0.3%CVE-2025-59838LOWMonkeytype Vulnerable to Self-XSS on loading saved custom textEPSS 0.3%CVE-2025-14114MEDIUM1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-60916MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas beforEPSS 0.3%CVE-2026-1889MEDIUMOutgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' AttributeEPSS 0.3%CVE-2025-22725HIGHWordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50964MEDIUMuBidAuction 2.0.1 myAuctions loose Reflected XSSEPSS 0.3%CVE-2022-50962MEDIUMuBidAuction 2.0.1 myOrders Reflected XSSEPSS 0.3%CVE-2026-65545HIGHWordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1454HIGHResponsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%