Weaknesses of type CWE-79

30,540 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-10737MEDIUMOpen Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.2%CVE-2025-8413MEDIUMListeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud ShortcodeEPSS 0.2%CVE-2021-47968MEDIUMPodcast Generator 3.1 Persistent Cross-Site Scripting via long_descriptionEPSS 0.2%CVE-2025-11830MEDIUMWP Restaurant Listings <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-2300MEDIUMBJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML BlockEPSS 0.2%CVE-2025-62991MEDIUMWordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12649MEDIUMSortTable Post <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-62135MEDIUMWordPress Responsive Block Control plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-107306LOWMenu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209EPSS 0.2%CVE-2026-116749MEDIUMVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block AttributeEPSS 0.2%CVE-2026-39812MEDIUMA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through EPSS 0.2%CVE-2026-6962MEDIUMCost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-60646HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2025-62748MEDIUMWordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-8872MEDIUMAnimate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-63021MEDIUMWordPress Valenti Engine plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39426MEDIUMMaxKB: Stored XSS via Unsanitized iframe_render ParsingEPSS 0.2%CVE-2025-11878MEDIUMST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11869MEDIUMPrecise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12652MEDIUMUngapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%