Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-60451MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficieEPSS 0.2%CVE-2025-26556HIGHWordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49433MEDIUMWordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-63543MEDIUMTechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter.EPSS 0.2%CVE-2026-109216MEDIUMMeta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array KeysEPSS 0.2%CVE-2026-10093MEDIUMFile Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' ParameterEPSS 0.2%CVE-2026-6817MEDIUMQuiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'EPSS 0.2%CVE-2021-42193MEDIUMnopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, theEPSS 0.2%CVE-2025-26774HIGHWordPress Responsive Modal Builder for High Conversion – Easy Popups plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109884HIGHWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26554HIGHWordPress WP Discord Post Plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-34266MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menusEPSS 0.2%CVE-2025-26972HIGHWordPress PrivateContent plugin <= 8.11.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-15463MEDIUMSSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' ParametersEPSS 0.2%CVE-2024-51604MEDIUMWordPress Media Modal plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48151HIGHWordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-52074MEDIUMPHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameteEPSS 0.2%CVE-2026-32840MEDIUMEdimax GS-5008PL <= 1.00.54 Stored XSS via Device NameEPSS 0.2%CVE-2026-61993HIGHWordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53215HIGHWordPress Yahoo! WebPlayer Plugin <= 2.0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%