Weaknesses of type CWE-79

30,309 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22282HIGHWordPress ez Form Calculator Premouium plugin <= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25595MEDIUMInvoicePlane has Stored XSS via Invoice Number in Invoice View and DashboardEPSS 0.2%CVE-2026-14203MEDIUMSmart Manager < 8.92.0 - Contributor+ Stored XSS via Post TitleEPSS 0.2%CVE-2024-9058MEDIUMElement Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox WidgetEPSS 0.2%CVE-2025-31905HIGHWordPress Team Rosters Plugin <= 4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-12921MEDIUMEthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico ShortcodeEPSS 0.2%CVE-2025-43735MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2025-40616MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in BookgyEPSS 0.2%CVE-2025-0420MEDIUMXSS in Mikrogrup's ParaşütEPSS 0.2%CVE-2024-11832MEDIUMBeaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12160HIGHSimple User Registration <= 6.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-78364LOWMW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data ListEPSS 0.2%CVE-2025-0879MEDIUMXSS in Shopside Software's Shopside AppEPSS 0.2%CVE-2025-15694LOWJoli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSSEPSS 0.2%CVE-2026-95684HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' ParameterEPSS 0.2%CVE-2026-97663HIGHCustomer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2026-4081MEDIUMZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-107742HIGH10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2025-60318MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First NEPSS 0.2%CVE-2026-95670HIGHNo External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} RedirectEPSS 0.2%