Weaknesses of type CWE-79

30,519 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-31354MEDIUMMultiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to eEPSS 0.2%CVE-2025-69054HIGHWordPress Super Logos Showcase plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64203HIGHWordPress Mailster plugin < 4.1.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67927HIGHWordPress Link Whisper Free plugin <= 0.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2499MEDIUMCustom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path SettingEPSS 0.2%CVE-2026-39333HIGHChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpEPSS 0.2%CVE-2025-26778MEDIUMWordPress Gallery Custom Links Plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64189HIGHWordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67533HIGHWordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64191HIGHWordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-30919HIGHfacileManager Affected by Stored Cross-Site Scripting (XSS)EPSS 0.2%CVE-2025-27002HIGHWordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111088MEDIUMStored XSS in the VPN logs monitorEPSS 0.2%CVE-2025-67918HIGHWordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-31352MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execuEPSS 0.2%CVE-2025-64207HIGHWordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68858HIGHWordPress wpCAS plugin <= 1.07 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-34236MEDIUMAdvantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()EPSS 0.2%CVE-2026-84095HIGHWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review ImportEPSS 0.2%CVE-2026-1071MEDIUMCarta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%