Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-54408MEDIUMFrappe before 14.31.0 HTML Injection via Weak EscapingEPSS 0.2%CVE-2025-62912MEDIUMWordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62930MEDIUMWordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-26270MEDIUMInvoicePlane has Stored Cross-Site Scripting Issue in Identifier FormattingEPSS 0.2%CVE-2025-67539MEDIUMWordPress Select Core plugin < 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119520MEDIUMWordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120850MEDIUMWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62939MEDIUMWordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2022-50958MEDIUMWordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.phpEPSS 0.2%CVE-2026-44903MEDIUMPrometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UIEPSS 0.2%CVE-2025-66053MEDIUMWordPress Enfold theme <= 7.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59540MEDIUMChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackEPSS 0.2%CVE-2025-62032MEDIUMWordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-55059MEDIUMA stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php.EPSS 0.2%CVE-2025-62940MEDIUMWordPress Blox Lite plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39739MEDIUMWordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-33548HIGHMantisBT has Stored HTML Injection / XSS when displaying Tags in TimelineEPSS 0.2%CVE-2025-67536MEDIUMWordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62949MEDIUMWordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62937MEDIUMWordPress Post List Featured Image plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%