Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-69088MEDIUMWordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-8106MEDIUMReflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theftEPSS 0.2%CVE-2026-3361MEDIUMWP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post MetaEPSS 0.2%CVE-2026-29520MEDIUMHereta ETH-IMC408M Reflected XSS via ping_ipaddr ParameterEPSS 0.2%CVE-2026-97238MEDIUMWordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-105316HIGHMagee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode ActionsEPSS 0.2%CVE-2026-5429HIGHKiro IDE Webview Cross-Site Scripting via Workspace Color ThemeEPSS 0.2%CVE-2025-68528MEDIUMWordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40038MEDIUMPachno 1.0.6 Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%CVE-2026-4420MEDIUMStored XSS via Page Creating functionality in BluditEPSS 0.2%CVE-2025-68513MEDIUMWordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116803MEDIUMDOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached SubtreesEPSS 0.2%CVE-2026-54681MEDIUMDiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML exportEPSS 0.2%CVE-2026-34821MEDIUMEndian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-0256MEDIUMPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceEPSS 0.2%CVE-2026-29828MEDIUMDooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.EPSS 0.2%CVE-2026-39840MEDIUMCSS injection in multiple Cargo display formatsEPSS 0.2%CVE-2026-110981HIGHWP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' ParameterEPSS 0.2%CVE-2025-62758MEDIUMWordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-92412HIGHFive Star Restaurant Reviews < 2.3.14 - Reflected XSSEPSS 0.2%