Weaknesses of type CWE-79

30,519 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22496MEDIUMWordPress Notif Bell Plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-39448MEDIUMWordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1661MEDIUMWP Mail Logging < 1.17.0 - Unauthenticated HTML InjectionEPSS 0.2%CVE-2025-65956MEDIUMFormwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog TagsEPSS 0.2%CVE-2025-10280HIGHIncorrect Content Type Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-49442MEDIUMWordPress Simple Nested Menu plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-43807MEDIUMStored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.EPSS 0.2%CVE-2025-27514MEDIUMGLPI is susceptible to Stored XSS attack through project's kanbanEPSS 0.2%CVE-2025-48305MEDIUMWordPress Goal Tracker for Patreon plugin <= 0.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31101MEDIUMWordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-0917MEDIUMIBM Cognos Analytics cross-site scriptingEPSS 0.2%CVE-2025-58263MEDIUMWordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4083MEDIUMScoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-43841MEDIUMWordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25316MEDIUMGOautodial 4.0 - 'CreateEvent' Persistent Cross-Site ScriptingEPSS 0.2%CVE-2026-27512MEDIUMTenda F3 Reflected Script Execution via Missing nosniff HeaderEPSS 0.2%CVE-2025-27585MEDIUMA stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 alEPSS 0.2%CVE-2025-49443MEDIUMWordPress Bacon Ipsum plugin <= 2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-96358MEDIUMWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158EPSS 0.2%CVE-2025-66081MEDIUMWordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%