Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-49061MEDIUMWordPress Porn Videos Embed plugin <= 0.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49909HIGHWordPress Penci Bookmark & Follow plugin < 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62036HIGHWordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48527HIGHHaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpointEPSS 0.2%CVE-2026-119211MEDIUMAAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' HookEPSS 0.2%CVE-2025-3704MEDIUMWordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48154HIGHWordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-63317MEDIUMTodoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JEPSS 0.2%CVE-2025-49904HIGHWordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-24641HIGHWordPress Better WishList API plugin <= 1.1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-56243MEDIUMA Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the eventEPSS 0.2%CVE-2025-34258MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/planEPSS 0.2%CVE-2025-56807MEDIUMA cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScEPSS 0.2%CVE-2025-55620MEDIUMA cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbEPSS 0.2%CVE-2026-34694MEDIUMAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-105077HIGHWordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13141MEDIUMHT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute InjectionEPSS 0.2%CVE-2025-23788HIGHWordPress Easy Filter Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-44708MEDIUMMistune Math Plugin XSS Escape BypassEPSS 0.2%CVE-2026-121765HIGHWordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%