Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22650MEDIUMWordPress Smartarget.online Integration plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46529MEDIUMWordPress Business Contact Widget plugin <= 2.7.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-33865MEDIUMStored XSS via unsafe YAML parsing in MLflowEPSS 0.2%CVE-2025-26745MEDIUMWordPress RS Elements Elementor Addon plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-44760MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)EPSS 0.2%CVE-2025-47665MEDIUMWordPress N360 | Splash Screen plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13071HIGHCustom Admin Menu <= 1.0.0 - Reflected XSSEPSS 0.2%CVE-2026-3983MEDIUMCampcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scriptingEPSS 0.2%CVE-2025-27754MEDIUMExtension - rsjoomla.com - A stored XSS vulnerability RSBlog! component 1.11.6 - 1.14.4 for JoomlaEPSS 0.2%CVE-2026-27147MEDIUMGetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)EPSS 0.2%CVE-2026-97630MEDIUMFV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode AttributeEPSS 0.2%CVE-2025-32214MEDIUMWordPress Hive Support plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-5139MEDIUMCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionEPSS 0.2%CVE-2025-2159MEDIUMStored XSS in M-Files Admin user interfaceEPSS 0.2%CVE-2024-58128MEDIUMIn MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin EPSS 0.2%CVE-2025-43800MEDIUMCross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throuEPSS 0.2%CVE-2025-46523MEDIUMWordPress COVID-19 (Coronavirus) Update Your Customers plugin <= 1.5.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22816MEDIUMWordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-43818MEDIUMCross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 throEPSS 0.2%CVE-2025-31875MEDIUMWordPress FancyPost plugin <= 6.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%