Weaknesses of type CWE-79

29,743 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23718HIGHWordPress Mancx AskMe Widget plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26585HIGHWordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23847HIGHWordPress Site Launcher Plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5901MEDIUMSiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widgetEPSS 0.4%CVE-2026-25487MEDIUMCraft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege EscalationEPSS 0.4%CVE-2026-18682LOWOpenAkita File Upload API upload cross site scriptingEPSS 0.4%CVE-2025-25108HIGHWordPress SW Plus Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-54421HIGHNamelessMC allows Stored Cross Site Scripting (XSS) in SEO componentEPSS 0.4%CVE-2025-23668HIGHWordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-30741MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.4%CVE-2025-25102HIGHWordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9777MEDIUMAshe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2024-38364LOWDSpace Cross Site Scripting (XSS) via a deposited HTML/XML documentEPSS 0.4%CVE-2025-23731HIGHWordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-52161CRITICALScholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.EPSS 0.4%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.4%CVE-2025-0576MEDIUMMobotix M15 player cross site scriptingEPSS 0.4%CVE-2025-23606HIGHWordPress Calendi plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25164HIGHWordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23956HIGHWordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%