Weaknesses of type CWE-79

30,371 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23950MEDIUMWordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-20258HIGHStored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk EnterpriseEPSS 0.2%CVE-2023-53977MEDIUMmyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum ManagementEPSS 0.2%CVE-2026-22233MEDIUMOPEXUS eCASE Audit Project Cost stored XSSEPSS 0.2%CVE-2025-27825MEDIUMAn XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class EPSS 0.2%CVE-2025-25916MEDIUMwuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.EPSS 0.2%CVE-2025-23941MEDIUMWordPress MeinTurnierplan.de Widget Viewer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31883MEDIUMWordPress WebinarPress plugin <= 1.33.28 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111122HIGHSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual InspectorEPSS 0.2%CVE-2026-61988HIGHWordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-33844MEDIUMIBM Security Verify Governance cross-site scriptingEPSS 0.2%CVE-2026-8898MEDIUMEvents In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-48537MEDIUMGFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspxEPSS 0.2%CVE-2026-45694MEDIUMLibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parametersEPSS 0.2%CVE-2026-42138MEDIUMDify Vulnerable to Stored XSS via SVG-file uploadEPSS 0.2%CVE-2025-10138MEDIUMThis-or-That by André Boekhorst <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-59006HIGHWordPress Easy Woocommerce Customizer plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-52764HIGHWordPress flexoslider plugin <= 1.0004 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34097MEDIUMGuardian Language-System XSS via id Parameter in text_file.phpEPSS 0.2%CVE-2025-53239HIGHWordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%