Weaknesses of type CWE-79

30,523 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-4169MEDIUMTecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scriptingEPSS 0.2%CVE-2025-11737MEDIUMVK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS TitleEPSS 0.2%CVE-2026-28102HIGHWordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22278MEDIUMWordPress Whitish Lite theme <= 2.1.13 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-51965MEDIUMOURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My UseEPSS 0.2%CVE-2024-9019MEDIUMSecuPress Free — WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form ShortcodeEPSS 0.2%CVE-2025-31434MEDIUMWordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.19 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-31088MEDIUMWordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-30961MEDIUMWordPress Trackserver plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68501HIGHWordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31094MEDIUMWordPress WP Posts Carousel plugin <= 1.3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-31096MEDIUMWordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-28037HIGHWordPress EventON plugin <= 4.9.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27363HIGHWordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27385HIGHWordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31607MEDIUMWordPress Simple-Audioplayer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111069MEDIUMGeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom FieldEPSS 0.2%CVE-2025-31043MEDIUMWordPress JetSearch plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4356MEDIUMitsourcecode University Management System add_result.php cross site scriptingEPSS 0.2%CVE-2026-27353HIGHWordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%