Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-59592MEDIUMWordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-28109HIGHWordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60983MEDIUMReflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints.EPSS 0.2%CVE-2025-59587MEDIUMWordPress Penci Shortcodes & Performance Plugin < 6.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-28122HIGHWordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116874MEDIUMSemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default ParameterEPSS 0.2%CVE-2025-41101MEDIUMMultiple vulnerabilities in Fairsketch's RISE CRM FrameworkEPSS 0.2%CVE-2026-28113HIGHWordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28127HIGHWordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-10503MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity ServerEPSS 0.2%CVE-2026-106141MEDIUMCross-Site Scripting in Progress Software Kendo UI for AngularEPSS 0.2%CVE-2026-106134MEDIUMCross-Site Scripting in Progress Software KendoReactEPSS 0.2%CVE-2025-66284MEDIUMStored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, anEPSS 0.2%CVE-2025-66102HIGHWordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-106136MEDIUMCross-Site Scripting in Progress Software KendoReactEPSS 0.2%CVE-2026-14876MEDIUMSmart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML BlockEPSS 0.2%CVE-2026-120855MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-55062MEDIUMPriority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')EPSS 0.2%CVE-2026-96368MEDIUMWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163EPSS 0.2%CVE-2025-69082HIGHWordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%