Weaknesses of type CWE-79

30,540 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-25453MEDIUMWordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-47760HIGHTinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGsEPSS 0.2%CVE-2026-37503MEDIUMCross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in pEPSS 0.2%CVE-2026-108815MEDIUMidcCMS member_deal.php cross site scriptingEPSS 0.2%CVE-2026-25432MEDIUMWordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-30578MEDIUMFile Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invEPSS 0.2%CVE-2026-32430MEDIUMWordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7110MEDIUMcode-projects Invoice System in Laravel item cross site scriptingEPSS 0.2%CVE-2025-53307HIGHWordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-30579MEDIUMFile Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a fiEPSS 0.2%CVE-2026-8656MEDIUMVersions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper EPSS 0.2%CVE-2026-118549HIGHAI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269EPSS 0.2%CVE-2026-100880MEDIUMzhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scriptingEPSS 0.2%CVE-2026-32411MEDIUMWordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25307MEDIUMWordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-105099MEDIUMOmega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scriptingEPSS 0.2%CVE-2026-31918MEDIUMWordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32424MEDIUMWordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102264MEDIUMmwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scriptingEPSS 0.2%CVE-2025-64224HIGHWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%