Weaknesses of type CWE-79

30,520 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22496MEDIUMWordPress Notif Bell Plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-21904MEDIUMJunos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2026-32360MEDIUMWordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31101MEDIUMWordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31605MEDIUMWordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66081MEDIUMWordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6674MEDIUMCKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081EPSS 0.2%CVE-2025-58263MEDIUMWordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-6061MEDIUMkk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43841MEDIUMWordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25315MEDIUMWP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site ScriptingEPSS 0.2%CVE-2025-60104MEDIUMWordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-0917MEDIUMIBM Cognos Analytics cross-site scriptingEPSS 0.2%CVE-2025-49450MEDIUMWordPress SEPA Girocode plugin <= 0.5.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-6716MEDIUMContest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-96361MEDIUMWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155EPSS 0.2%CVE-2025-31610MEDIUMWordPress Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27924MEDIUMNintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.EPSS 0.2%CVE-2025-31031MEDIUMWordPress Job Colors for WP Job Manager plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58266MEDIUMWordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%