Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-60142MEDIUMWordPress Simple Meta Tags Plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58241MEDIUMWordPress SnapWidget Social Photo Feed Widget Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48922MEDIUMGLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078EPSS 0.2%CVE-2025-44141MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.EPSS 0.2%CVE-2025-60138MEDIUMWordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60124MEDIUMWordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-15273MEDIUMAutomatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URIEPSS 0.2%CVE-2025-58974MEDIUMWordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-107801MEDIUMJivejdon through 5.0 Stored XSS via Attachment Upload Content-TypeEPSS 0.2%CVE-2025-43755MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 20EPSS 0.2%CVE-2026-92098MEDIUMWebheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' ParameterEPSS 0.2%CVE-2025-2141MEDIUMIBM System Storage Virtualization Engine TS7700 cross-site scriptingEPSS 0.2%CVE-2025-48168HIGHWordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48356MEDIUMWordPress Kanpress plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58027MEDIUMWordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-60102MEDIUMWordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-60040MEDIUMWordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-103998MEDIUMForm Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array KeyEPSS 0.2%CVE-2025-50055MEDIUMCross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows conEPSS 0.2%CVE-2025-30987MEDIUMWordPress JetBlocks For Elementor plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%