Weaknesses of type CWE-79

30,470 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-48286HIGHWordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22791HIGHWordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1300MEDIUMResponsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ParametersEPSS 0.2%CVE-2025-11884LOWCross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDBEPSS 0.2%CVE-2025-31464MEDIUMWordPress Text Selection Color plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-10029MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.EPSS 0.2%CVE-2026-6246MEDIUMSimple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode AttributeEPSS 0.2%CVE-2022-44759MEDIUMHCL Leap is affected by Cross-site scripting (XSS)EPSS 0.2%CVE-2025-62267MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3EPSS 0.2%CVE-2025-22653MEDIUMWordPress Music Press Pro plugin <=1.4.6 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63066MEDIUMWordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2020-36960MEDIUMForma LMS 2.3 - 'First & Last Name' Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22674MEDIUMWordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46250MEDIUMWordPress VForm plugin <= 3.1.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27360MEDIUMWordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7222MEDIUMcode-projects Coaching Management System Complaint Form complaint.php cross site scriptingEPSS 0.2%CVE-2025-31627MEDIUMWordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4032MEDIUMCodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment ShortcodeEPSS 0.2%CVE-2026-76346MEDIUMStored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk EnterpriseEPSS 0.2%CVE-2025-31470MEDIUMWordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%