Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-64094MEDIUMDNN vulnerable to stored cross-site-scripting (XSS) via SVG uploadEPSS 0.2%CVE-2026-103520MEDIUMHivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML FormatEPSS 0.2%CVE-2026-97077HIGHWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-5506MEDIUMWavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-95515HIGHWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7390MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php customer cross site scriptingEPSS 0.2%CVE-2026-5711MEDIUMPost Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block AttributeEPSS 0.2%CVE-2026-114229—Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionEPSS 0.2%CVE-2026-34206MEDIUMCaptcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/templateEPSS 0.2%CVE-2025-13056MEDIUMA user with elevated privileges can inject XSS in the Administration ACL Menus configuration pageEPSS 0.2%CVE-2026-93656MEDIUMUser Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar FieldEPSS 0.2%CVE-2023-5648MEDIUMIn Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unautEPSS 0.2%CVE-2025-3153MEDIUMConcrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeEPSS 0.2%CVE-2026-96836HIGHWordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110017MEDIUMQuick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode AttributeEPSS 0.2%CVE-2025-43742MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QEPSS 0.2%CVE-2026-12241MEDIUMAdvanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-6809MEDIUMSocial Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads EmbedEPSS 0.2%CVE-2026-42650HIGHWordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6800MEDIUMFastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%