Weaknesses of type CWE-79

30,585 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-39742MEDIUMWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32429MEDIUMWordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-9414MEDIUMSourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scriptingEPSS 0.2%CVE-2022-50961MEDIUMWordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSSEPSS 0.2%CVE-2026-55650MEDIUMOuterbase Studio: Stored XSS in Text Widget Leads to Authentication Token ExposureEPSS 0.2%CVE-2025-64224HIGHWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-107435HIGHWordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-93875HIGHJetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' ParameterEPSS 0.2%CVE-2025-25823HIGHA cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a craEPSS 0.2%CVE-2025-55711MEDIUMWordPress WP Table Builder Plugin <= 2.0.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-96768HIGHGoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log BodyEPSS 0.2%CVE-2025-12032MEDIUMZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-116405HIGHWordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-86610MEDIUMDownload Manager < 3.3.71 - Author+ Stored XSS via Package IconEPSS 0.2%CVE-2026-97645HIGHGravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List FieldEPSS 0.2%CVE-2025-55714MEDIUMWordPress JetElements For Elementor Plugin <= 2.7.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-12393MEDIUMFree Quotation <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-23861MEDIUMDell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-siteEPSS 0.2%CVE-2025-36408MEDIUMMultiple vulnerabilities found in IBM ApplinX.EPSS 0.2%CVE-2026-8143HIGHBooking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%