Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62060MEDIUMWordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-90443MEDIUMCross-site Scripting in MalcolmEPSS 0.2%CVE-2025-62069MEDIUMWordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-31350MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTEPSS 0.2%CVE-2025-36113MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2025-36409MEDIUMMultiple vulnerabilities found in IBM ApplinX.EPSS 0.2%CVE-2025-62063MEDIUMWordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28359MEDIUMNocoDB: Stored Cross-Site Scripting via Rich Text FieldEPSS 0.2%CVE-2026-40807HIGHWordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27371HIGHWordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104670HIGHWordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34802MEDIUMEndian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-68872HIGHWordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42715HIGHWordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57701MEDIUMReflected Cross-site Scripting in DIAEnergieEPSS 0.2%CVE-2026-100507HIGHWordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104672HIGHWordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62116HIGHWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57806HIGHWordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-61989HIGHWordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%