Weaknesses of type CWE-79

30,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-67629MEDIUMWordPress Basticom Framework plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50927MEDIUMA reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to EPSS 0.2%CVE-2025-64491MEDIUMSuiteCRM is vulnerable to unauthenticated reflected XSS through its Login pageEPSS 0.2%CVE-2026-115535MEDIUMgedelumbung HospitalManagement Settings sistem.php simpan cross site scriptingEPSS 0.2%CVE-2026-5834MEDIUMcode-projects Online Shoe Store admin_running.php cross site scriptingEPSS 0.2%CVE-2025-67632MEDIUMWordPress Google AdSense for Responsive Design – GARD plugin <= 2.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67555MEDIUMWordPress UseStrict's Calendly Embedder plugin <= 1.1.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-5668MEDIUMCyber-III Student-Management-System add%20notice.php cross site scriptingEPSS 0.2%CVE-2025-67628MEDIUMWordPress Review Disclaimer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62904MEDIUMWordPress WP Geo plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15019MEDIUMBIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-9980MEDIUMMultiple Stored XSS in QuickCMSEPSS 0.2%CVE-2025-49960MEDIUMWordPress LeadBI Plugin for WordPress plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4575MEDIUMcode-projects Exam Form Submission update_s2.php cross site scriptingEPSS 0.2%CVE-2025-62900MEDIUMWordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6060MEDIUMXSS in DECE Software's GeodiEPSS 0.2%CVE-2025-66066MEDIUMWordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120421MEDIUMReflected XSS via client window id in URL client window modeEPSS 0.2%CVE-2026-1611MEDIUMWikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-1608MEDIUMVideo Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%