Weaknesses of type CWE-79

30,595 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-24943HIGHWordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-118095MEDIUMWordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39667MEDIUMWordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66501MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text FeatureEPSS 0.2%CVE-2026-39615MEDIUMWordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24948HIGHWordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-117537LOWREDAXO before 5.21.0 Reflected XSS via Metainfo API type ParameterEPSS 0.2%CVE-2026-75059MEDIUMIn JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possibleEPSS 0.2%CVE-2026-116849MEDIUMWordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-123472MEDIUMWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116885MEDIUMSemantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id ParameterEPSS 0.2%CVE-2026-117538LOWREDAXO before 5.21.0 Reflected XSS via Packages API function ParameterEPSS 0.2%CVE-2026-39654MEDIUMWordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4335MEDIUMShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment TitleEPSS 0.2%CVE-2026-6059MEDIUMA cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web managEPSS 0.2%CVE-2026-39541MEDIUMWordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39638MEDIUMWordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-1382MEDIUMContact Us By Lord Linus <= 2.6 - Admin+ Stored XSS via CSRFEPSS 0.2%CVE-2026-3215MEDIUMIslandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016EPSS 0.2%CVE-2026-24949HIGHWordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%