Weaknesses of type CWE-79

30,316 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-28179MEDIUMWordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1395MEDIUMGutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block AttributesEPSS 0.2%CVE-2024-37541MEDIUMWordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50985MEDIUMdiskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. UnsanitizedEPSS 0.2%CVE-2025-68081MEDIUMWordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67724MEDIUMTornado vulnerable to Header Injection and XSS via reason argumentEPSS 0.2%CVE-2025-7810MEDIUMStreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-27365MEDIUMWordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60158MEDIUMWordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50986MEDIUMdiskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settingsEPSS 0.2%CVE-2023-42007MEDIUMIBM Sterling Control Center cross-site scriptingEPSS 0.2%CVE-2024-56268MEDIUMWordPress Post Grid Elementor Addon plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-65186MEDIUMGrav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown EPSS 0.2%CVE-2025-10133MEDIUMURLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-0741MEDIUMElectric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ParametersEPSS 0.2%CVE-2026-27746MEDIUMSPIP jeux < 4.1.1 Reflected XSS via index ParametersEPSS 0.2%CVE-2025-8445MEDIUMCountdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'EPSS 0.2%CVE-2025-62359MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint id_petEPSS 0.2%CVE-2024-37554MEDIUMWordPress UltraAddons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48867MEDIUMHorilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task ModulesEPSS 0.2%