Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62146MEDIUMWordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58862MEDIUMWordPress WordPress Events Calendar Plugin – connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-10551HIGHStored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2026-48227MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id ParametersEPSS 0.2%CVE-2025-68533MEDIUMWordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62137MEDIUMWordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-30162MEDIUMCross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.EPSS 0.2%CVE-2025-58196MEDIUMWordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58864MEDIUMWordPress 金数据 Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58985MEDIUMWordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13097MEDIUMInappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox EPSS 0.2%CVE-2025-58197MEDIUMWordPress Simple Download Monitor Plugin <= 3.9.34 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-124491MEDIUMSunEditor before 3.4.0 Stored XSS via FileUpload Plugin FilenameEPSS 0.2%CVE-2025-58632MEDIUMWordPress Dadevarzan WordPress Common Plugin <= 2.2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-111095HIGHIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possibleEPSS 0.2%CVE-2025-58989MEDIUMWordPress Dynamic Text Field For Contact Form 7 Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58988MEDIUMWordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58640MEDIUMWordPress Document Engine Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58626MEDIUMWordPress RumbleTalk Live Group Chat Plugin <= 6.3.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-104466MEDIUMYesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src AttributeEPSS 0.2%