Weaknesses of type CWE-79

30,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53212HIGHWordPress Revolution Video Player With Bottom Playlist <= 2.9.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-61796MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-61636NONECodex Special:Block vulnerable to message key XSSEPSS 0.2%CVE-2026-97640HIGHWPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)EPSS 0.2%CVE-2025-48163HIGHWordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53290MEDIUMWordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-5063HIGHNEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key NamesEPSS 0.2%CVE-2026-103996MEDIUMIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' AttributeEPSS 0.2%CVE-2026-54866HIGHWordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62264MEDIUMReflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.QEPSS 0.2%CVE-2025-58177MEDIUMn8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameterEPSS 0.2%CVE-2026-5340MEDIUMFancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-109147HIGHWP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' ParameterEPSS 0.2%CVE-2025-22483HIGHLicense CenterEPSS 0.2%CVE-2026-109978MEDIUMCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block AttributeEPSS 0.2%CVE-2025-63057MEDIUMWordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22697MEDIUMWordPress Responsive Blocks plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54676MEDIUMWordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53563HIGHWordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53562HIGHWordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%