Weaknesses of type CWE-79

29,745 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-25164HIGHWordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25487MEDIUMCraft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege EscalationEPSS 0.4%CVE-2025-23601HIGHWordPress Tab My Content plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6248HIGHA cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information iEPSS 0.4%CVE-2023-23833MEDIUMWordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23728MEDIUMWordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-26586HIGHWordPress Events Planner Plugin <= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26585HIGHWordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25170HIGHWordPress Migrate Posts Plugin <=1.0 - Post Based Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23956HIGHWordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23718HIGHWordPress Mancx AskMe Widget plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.4%CVE-2025-23731HIGHWordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23964HIGHWordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-7085HIGHExposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM).EPSS 0.4%CVE-2022-45814MEDIUMWordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24003MEDIUMWordPress WP Popups Plugin <= 2.1.4.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-25090HIGHWordPress Dreamstime Stock Photos plugin <= 4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23716HIGHWordPress Login Watchdog plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-54421HIGHNamelessMC allows Stored Cross Site Scripting (XSS) in SEO componentEPSS 0.4%