Weaknesses of type CWE-79

30,465 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53226HIGHWordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48296HIGHWordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-31029HIGHWordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-34098MEDIUMGuardian Language-System XSS via id Parameter in media.phpEPSS 0.2%CVE-2026-110525HIGHMCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-AgentEPSS 0.2%CVE-2026-63105MEDIUMReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket SystemsEPSS 0.2%CVE-2026-116535MEDIUMSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template TagEPSS 0.2%CVE-2026-48539MEDIUMGFI Archiver < 15.14 Stored XSS via MailInsights.aspxEPSS 0.2%CVE-2026-8866MEDIUMjQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-49411HIGHWordPress iFrame Block plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-11863MEDIUMMy Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-85657MEDIUMCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' ParameterEPSS 0.2%CVE-2026-92590MEDIUMCraft CMS 5.7.0 before 5.10.13 Stored XSS via Generated FieldsEPSS 0.2%CVE-2026-51153MEDIUMStored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /EPSS 0.2%CVE-2025-52771MEDIUMWordPress Video Expander Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-23176MEDIUMAn issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key mEPSS 0.2%CVE-2025-53297HIGHWordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-13718MEDIUMTabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab ContentEPSS 0.2%CVE-2025-25018HIGHKibana Stored Cross-Site Scripting (XSS)EPSS 0.2%CVE-2026-82790MEDIUMCross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulEPSS 0.2%