Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-58002MEDIUMWordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-3878MEDIUMWP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'EPSS 0.2%CVE-2025-45585MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrEPSS 0.2%CVE-2025-59553MEDIUMWordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58593MEDIUMWordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-8429MEDIUMA user with elevated privileges can inject XSS in the ACL Action access configuration pageEPSS 0.2%CVE-2026-120643MEDIUMCGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlEPSS 0.2%CVE-2025-68847HIGHWordPress iSape plugin <= 0.72 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14448MEDIUMWP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile FieldsEPSS 0.2%CVE-2025-4599LOWThe fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 throEPSS 0.2%CVE-2026-40028MEDIUMHayabusa < 3.8.0 XSS via JSON Log ImportEPSS 0.2%CVE-2026-103686MEDIUMrhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scriptingEPSS 0.2%CVE-2025-68848HIGHWordPress amr cron manager plugin <= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34606MEDIUMStored XSS in Frappe LMSEPSS 0.2%CVE-2025-69323HIGHWordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-4294MEDIUMXSS in HotelRunner's B2BEPSS 0.2%CVE-2026-2425MEDIUMhiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' ParameterEPSS 0.2%CVE-2025-54013MEDIUMWordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-31119MEDIUMWordPress Download Special Box for Content plugin <= 1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-35466MEDIUMStored XSS via unsanitized input from remote serviceEPSS 0.2%