Weaknesses of type CWE-79

30,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-61914HIGHn8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe SandboxEPSS 0.2%CVE-2026-15283MEDIUMWPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22788MEDIUMWordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54699MEDIUMWordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-49241HIGHAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionEPSS 0.2%CVE-2025-48206MEDIUMThe ns_backup extension through 13.0.0 for TYPO3 allows XSS.EPSS 0.2%CVE-2025-11262HIGHLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-12037MEDIUMFrontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-37535HIGHHCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-7775MEDIUMCross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayEPSS 0.2%CVE-2026-3343MEDIUMWatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UIEPSS 0.2%CVE-2025-53631MEDIUMflaskBlog XSS Vulnerability in postContentEPSS 0.2%CVE-2026-39070MEDIUMWordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker wEPSS 0.2%CVE-2025-31900HIGHWordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31901HIGHWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15692LOWIcegram Express < 5.8.6 - Admin+ Stored XSSEPSS 0.2%CVE-2024-28973MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. EPSS 0.2%CVE-2024-51624HIGHWordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31902HIGHWordPress Social Share And Social Locker Plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%