Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-46540MEDIUMWordPress GNA Search Shortcode plugin <= 0.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-46536MEDIUMWordPress Carousel-of-post-images plugin <= 1.07 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-34263MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menusEPSS 0.2%CVE-2026-118054MEDIUMLearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' ParameterEPSS 0.2%CVE-2026-121519MEDIUMSocial Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' ParameterEPSS 0.2%CVE-2025-22803MEDIUMWordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12037MEDIUMWP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22810MEDIUMWordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58025MEDIUMWordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-1098MEDIUMCM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode AttributeEPSS 0.2%CVE-2025-46538MEDIUMWordPress Inline Text Popup plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-89193HIGHRobin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML ParserEPSS 0.2%CVE-2025-12453MEDIUMImproper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.EPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2025-8896MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-47656MEDIUMWordPress Spiraclethemes Site Library plugin <= 1.5.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-46335MEDIUMPHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-dateEPSS 0.2%CVE-2026-49102MEDIUMWebmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/EPSS 0.2%CVE-2025-62798MEDIUMSharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntaxEPSS 0.2%CVE-2025-13873MEDIUMThe feature to import a survey is prone to stored Cross-Site Script attacksEPSS 0.2%