Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-26874HIGHWordPress MemberSpace plugin <= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-0949MEDIUMPEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage ChEPSS 0.2%CVE-2026-44898MEDIUMMistune TOC Anchor Injection XSSEPSS 0.2%CVE-2025-58452LOWWeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'EPSS 0.2%CVE-2026-10024MEDIUMTinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode AttributeEPSS 0.2%CVE-2024-7103MEDIUMReflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login FlowEPSS 0.2%CVE-2026-39786HIGHWordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49905HIGHWordPress Range Slider Addon for Gravity Forms plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22579MEDIUMWordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23845HIGHWordPress ImageMeta Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57989MEDIUMWordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-14275MEDIUMJeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.2%CVE-2025-60304MEDIUMcode-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field.EPSS 0.2%CVE-2025-62031HIGHWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48097HIGHWordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26555HIGHWordPress Debug-Bar-Extender Plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23744HIGHWordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3244MEDIUMConcrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page NamesEPSS 0.2%CVE-2025-48162HIGHWordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-23687HIGHWordPress Woo Store Mode plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%