Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-56283MEDIUMCapgo - HTML Injection Leading to Open Redirection in Organization SettingsEPSS 0.2%CVE-2026-48229MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id ParameterEPSS 0.2%CVE-2025-58868MEDIUMWordPress SimaCookie Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48105MEDIUMWordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48927MEDIUMJenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58880MEDIUMWordPress Translate This gTranslate Shortcode Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58633MEDIUMWordPress Booking Ultra Pro Plugin <= 1.1.21 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-63000MEDIUMWordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58863MEDIUMWordPress Zoomify embed for WP Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58194MEDIUMWordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68512MEDIUMWordPress Real 3D FlipBook plugin <= 4.11.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58876MEDIUMWordPress Aparat Video Shortcode Plugin <= 0.2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58882MEDIUMWordPress Simple Text Slider Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-48226MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig ParametersEPSS 0.2%CVE-2025-58870MEDIUMWordPress WP-GraphViz Plugin <= 1.5.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58211MEDIUMWordPress Chatbox Manager Plugin <= 1.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58867MEDIUMWordPress Easy Download Media Counter Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48103MEDIUMWordPress Today's Date Inserter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109602MEDIUMFrappe before v16.31.0 Stored XSS via Dashboard Chart FiltersEPSS 0.2%CVE-2026-5725MEDIUMFavicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefixEPSS 0.2%