Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53220HIGHWordPress XmasB Quotes Plugin <= 1.6.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27348HIGHWordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53289HIGHWordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48152HIGHWordPress Rentsyst Plugin <= 2.0.100 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-24566HIGHWordPress Intro Tour Tutorial DeepPresentation plugin <= 6.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60450MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficieEPSS 0.2%CVE-2026-39338HIGHChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationEPSS 0.2%CVE-2025-58964HIGHWordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60445MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficieEPSS 0.2%CVE-2025-59556HIGHWordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-56018MEDIUMSourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category Management via the EPSS 0.2%CVE-2026-103863—Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathsEPSS 0.2%CVE-2025-61550MEDIUMCross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endEPSS 0.2%CVE-2024-13958MEDIUMStored Cross Site ScriptingEPSS 0.2%CVE-2024-58129MEDIUMIn MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with aEPSS 0.2%CVE-2025-22676MEDIUMWordPress Upcasted S3 Offload plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26732MEDIUMWordPress StoreBiz plugin <= 1.0.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46254MEDIUMWordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31894MEDIUMWordPress Ebook Downloader plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-69194MEDIUMFileRise: Unsanitized footerHtml in Public Site ConfigEPSS 0.2%