Weaknesses of type CWE-79

30,473 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-2389MEDIUMComplianz – GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content FilterEPSS 0.2%CVE-2026-42634HIGHWordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1151MEDIUMtechnical-laohu mpay User Center cross site scriptingEPSS 0.2%CVE-2026-32572HIGHWordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32570HIGHWordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32569HIGHWordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6088MEDIUMStored Cross-Site Scripting in StockAgile by Novadigits technologiesEPSS 0.2%CVE-2026-40765HIGHWordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42635HIGHWordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48871HIGHWordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-45551MEDIUMGroup-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting WriteEPSS 0.2%CVE-2024-13572MEDIUMPrecious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site ScriptingEPSS 0.2%CVE-2026-42636HIGHWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-22587MEDIUMIdeagen DevonWay Reports page stored XSSEPSS 0.2%CVE-2026-6084MEDIUMStored Cross-Site Scripting in StockAgile by Novadigits technologiesEPSS 0.2%CVE-2026-39766HIGHWordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2288MEDIUMmyLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' ParameterEPSS 0.2%CVE-2025-70519MEDIUMThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The laEPSS 0.2%CVE-2025-14662MEDIUMcode-projects Student File Management System Update User update_user.php cross site scriptingEPSS 0.2%CVE-2018-25269MEDIUMICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML InjectionEPSS 0.2%