Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-68900MEDIUMWordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48352MEDIUMWordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60101MEDIUMWordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-56451MEDIUMCross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/mainEPSS 0.2%CVE-2025-62240MEDIUMMultiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.EPSS 0.2%CVE-2025-49392MEDIUMWordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-92826MEDIUMEWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter KeyEPSS 0.2%CVE-2026-2728MEDIUMLibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploEPSS 0.2%CVE-2025-24841MEDIUMMovable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 EPSS 0.2%CVE-2025-62899MEDIUMWordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60154MEDIUMWordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60133MEDIUMWordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-57755MEDIUMWordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57373MEDIUMWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-0588MEDIUMXinhu Rainrock RockOA API rockfun.php cross site scriptingEPSS 0.2%CVE-2025-11950MEDIUMReflected XSS in Knowhy's EduAsistEPSS 0.2%CVE-2026-66703MEDIUMWordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-65233MEDIUMReflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/syscoEPSS 0.2%CVE-2026-65480MEDIUMWordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-30084MEDIUMExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for JoomlaEPSS 0.2%