Weaknesses of type CWE-79

30,595 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-41057MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-67932HIGHWordPress Listeo Core plugin < 2.0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-52739HIGHWordPress Sala theme <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102329MEDIUMCross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privilegeEPSS 0.2%CVE-2025-64376HIGHWordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12776LOWStored Cross-Site ScriptingEPSS 0.2%CVE-2026-27154LOWDiscourse has XSS when editing a malicious postEPSS 0.2%CVE-2025-23757HIGHWordPress ZD Scribd iPaper plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41059MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-66118HIGHWordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68873HIGHWordPress PRIMER by chloédigital plugin <= 1.0.25 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41048MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-50053HIGHWordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-24623HIGHWordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68874HIGHWordPress Visitor Stats Widget plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31642HIGHWordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40230MEDIUMHelpy 2.8.0 - Stored XSS in knowledgebase Doc body renderingEPSS 0.2%CVE-2025-41045MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-41056MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-41041MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%