Weaknesses of type CWE-79

30,540 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-10580MEDIUMWidget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11872MEDIUMMaterial Design Iconic Font Integration <= 2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11870MEDIUMSimple Business Data <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-103912MEDIUMJetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro RendererEPSS 0.2%CVE-2026-0670MEDIUMStored XSS through a system message and a user-provided parameter in ProofreadPageEPSS 0.2%CVE-2025-11867MEDIUMBg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-32125MEDIUMOpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/LabelsEPSS 0.2%CVE-2026-77188MEDIUMWaitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode AttributeEPSS 0.2%CVE-2025-62757MEDIUMWordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58630MEDIUMWordPress Simple Matomo Tracking Code Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-41539MEDIUMQTS, QuTS heroEPSS 0.2%CVE-2025-12645MEDIUMInline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-11866MEDIUMPhotographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11841MEDIUMGreenshift – animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data AttributesEPSS 0.2%CVE-2021-47927MEDIUMWordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_nameEPSS 0.2%CVE-2021-47929MEDIUMWordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSSEPSS 0.2%CVE-2026-22713LOWStored XSS through edit summaries in GrowthExperimentsEPSS 0.2%CVE-2025-30983MEDIUMWordPress Card flip image slideshow plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48055HIGHCombodo iTop has stored XSS in user portal's browse brickEPSS 0.2%CVE-2025-49032MEDIUMWordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%