Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-67552MEDIUMWordPress Walker Core plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62913MEDIUMWordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49908MEDIUMWordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64194MEDIUMWordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58070MEDIUMPleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitraryEPSS 0.2%CVE-2026-111844MEDIUMWordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62948MEDIUMWordPress Date counter plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67545MEDIUMWordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68915MEDIUMRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.EPSS 0.2%CVE-2025-54806MEDIUMGROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while lEPSS 0.2%CVE-2025-62951MEDIUMWordPress H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51226MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System EPSS 0.2%CVE-2025-62917MEDIUMWordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7437MEDIUMAzonPost <= 1.3 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-28263MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release verEPSS 0.2%CVE-2026-1450MEDIUMrognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' ParameterEPSS 0.2%CVE-2026-41003HIGHUnencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingEPSS 0.2%CVE-2026-119365MEDIUMWordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47947MEDIUMProjectsend r1295 Stored Cross-Site Scripting via files-edit.phpEPSS 0.2%CVE-2024-58394MEDIUMRetool < 3.88.0 XSS via /api/imageProxy SVG ProxyingEPSS 0.2%