Weaknesses of type CWE-79

30,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-105066HIGHWordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-50555MEDIUMWordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4022MEDIUMShow Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-105784MEDIUMJoplin whiteboard card rendering allows CSS injection into application chromeEPSS 0.2%CVE-2024-10088MEDIUMXSS in iKSORISEPSS 0.2%CVE-2026-48952MEDIUMJoomla! Core - [20260706] - XSS in com_installerEPSS 0.2%CVE-2025-54027HIGHWordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-10130MEDIUMLayers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-22328HIGHWordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48081HIGHOpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footerEPSS 0.2%CVE-2025-8397MEDIUMSave as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton ShortcodeEPSS 0.2%CVE-2026-3996MEDIUMWP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-8722MEDIUMContent Views <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List WidgetsEPSS 0.2%CVE-2025-62059HIGHWordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8200MEDIUMMega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer WidgetEPSS 0.2%CVE-2026-1806MEDIUMTour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-2433MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessageEPSS 0.2%CVE-2025-0513LOWIn affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of theEPSS 0.2%CVE-2026-112353MEDIUMGFI KerioConnect < 10.0.8p2 Stored XSS via SVG AttachmentEPSS 0.2%CVE-2026-104140MEDIUMQGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute valuesEPSS 0.2%