Weaknesses of type CWE-79

30,470 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11922MEDIUMInput Validation vulnerability in Web Client emails that do not go through Secure MailEPSS 0.2%CVE-2025-63064MEDIUMWordPress EventON plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46229MEDIUMWordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2021-47934MEDIUMMyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRFEPSS 0.2%CVE-2025-43804MEDIUMCross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1EPSS 0.2%CVE-2026-0749MEDIUMCross-Site Scripting Vulnerability in Drupal Form Builder ModuleEPSS 0.2%CVE-2026-3466HIGHCross-site scripting in dashlet titleEPSS 0.2%CVE-2025-22675MEDIUMWordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25647MEDIUMLute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlinkEPSS 0.2%CVE-2025-31471MEDIUMWordPress Duplicate Page and Post plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13975MEDIUMContact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' SettingsEPSS 0.2%CVE-2025-53397MEDIUMAdvantech iView Cross-site ScriptingEPSS 0.2%CVE-2025-22662MEDIUMWordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-33368MEDIUMZimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST intEPSS 0.2%CVE-2025-43781MEDIUMReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.EPSS 0.2%CVE-2025-14054MEDIUMWC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode AttributeEPSS 0.2%CVE-2025-43779MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.QEPSS 0.2%CVE-2026-2489MEDIUMTP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' TextareaEPSS 0.2%CVE-2025-58821MEDIUMWordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24591MEDIUMWordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%