Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-42150MEDIUMwlc: print_html outputs API data without HTML escaping, enabling stored XSSEPSS 0.2%CVE-2026-28110HIGHWordPress LambertGroup - AllInOne - Banner with Playlist plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32273MEDIUMDiscourse: XSS on category description update via APIEPSS 0.2%CVE-2025-41105MEDIUMMultiple vulnerabilities in Fairsketch's RISE CRM FrameworkEPSS 0.2%CVE-2025-58915MEDIUMWordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59584MEDIUMWordPress Penci Podcast Plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-121008MEDIUMSQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profileEPSS 0.2%CVE-2025-59583MEDIUMWordPress Penci Filter Everything Plugin < 1.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-62079MEDIUMWordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116875MEDIUMSemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator ParametersEPSS 0.2%CVE-2026-62080MEDIUMWordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41104MEDIUMMultiple vulnerabilities in Fairsketch's RISE CRM FrameworkEPSS 0.2%CVE-2026-96829MEDIUMWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-21788MEDIUMHCL Connections is vulnerable to cross-site scripting (XSS)EPSS 0.2%CVE-2026-94077MEDIUMWordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28137HIGHWordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28112HIGHWordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27072HIGHWordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41102MEDIUMMultiple vulnerabilities in Fairsketch's RISE CRM FrameworkEPSS 0.2%CVE-2026-28126HIGHWordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%