Weaknesses of type CWE-79

30,606 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-68597MEDIUMWordPress Jobs for WordPress plugin <= 2.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62743MEDIUMWordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63020MEDIUMWordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68076MEDIUMWordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3106CRITICALMultiple vulnerabilities in TeampassEPSS 0.2%CVE-2025-69357MEDIUMWordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66094MEDIUMWordPress Yada Wiki plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68070MEDIUMWordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59903MEDIUMStored Cross-Site Scripting (XSS) in KubysoftEPSS 0.2%CVE-2026-84151LOWThe Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List WideningEPSS 0.2%CVE-2025-41011MEDIUMHTML injection in PHP Point Of SaleEPSS 0.2%CVE-2026-13957MEDIUMIncorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious EPSS 0.2%CVE-2025-59904MEDIUMStored Cross-Site Scripting vulnerability in KubysoftEPSS 0.2%CVE-2026-53737MEDIUMJuicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API ResponseEPSS 0.2%CVE-2026-90821MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerEPSS 0.2%CVE-2026-50235MEDIUMLyrion Music Server 9.2.0 Reflected XSS via search ParametersEPSS 0.2%CVE-2025-48483MEDIUMFreeScout Stored XSS leads to CSRFEPSS 0.2%CVE-2026-118575MEDIUMSignature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285EPSS 0.2%CVE-2026-34624MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-4479MEDIUMWholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%