Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-61599MEDIUMEmlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown InputEPSS 0.2%CVE-2025-62750MEDIUMWordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109653HIGHFrappe ERPNext before 15.119.0 Stored XSS Leading to Account TakeoverEPSS 0.2%CVE-2023-47790HIGHWordPress Pz-LinkCard Plugin <= 2.4.8 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-25136MEDIUMWordPress Optimate Ads plugin <= 1.0.3 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-40643MEDIUMStored Cross-Site Scripting (XSS) in Energy CRM by Status TrackerEPSS 0.2%CVE-2025-31092MEDIUMWordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-43984HIGHTautulli has stored XSS in logFile via guest-controlled log_js_errors inputEPSS 0.2%CVE-2026-39332HIGHChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpEPSS 0.2%CVE-2026-109671HIGHFrappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal PagesEPSS 0.2%CVE-2025-14767MEDIUMWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' AttributeEPSS 0.2%CVE-2025-41001MEDIUMCross-Site Scripting (XSS) in SOPlanningEPSS 0.2%CVE-2025-62124MEDIUMWordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40479MEDIUMKimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member WidgetEPSS 0.2%CVE-2026-118189MEDIUMPosts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode AttributeEPSS 0.2%CVE-2026-118164MEDIUMIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' ParameterEPSS 0.2%CVE-2026-15917MEDIUMDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011EPSS 0.2%CVE-2026-23609MEDIUMGFI MailEssentials AI < 22.4 General Settings Perimeter SMTP Servers Description Stored XSSEPSS 0.2%CVE-2025-5275MEDIUMCharitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy SettingsEPSS 0.2%CVE-2026-23606MEDIUMGFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSSEPSS 0.2%