Weaknesses of type CWE-79

29,814 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-25113HIGHWordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-53968MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-25092HIGHWordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-46091MEDIUMCross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arEPSS 0.4%CVE-2025-26564HIGHWordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2024-1160MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon LinkEPSS 0.4%CVE-2025-26566HIGHWordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-0630MEDIUMWP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed SourceEPSS 0.4%CVE-2025-25070HIGHWordPress Album Reviewer plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25099HIGHWordPress Appointment Buddy Widget By Accrete plugin <= 1.2. - Reflected Cross-Site Scripting vulnerabilityEPSS 0.4%CVE-2025-51541MEDIUMA stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuratioEPSS 0.4%CVE-2026-25486MEDIUMCraft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege EscalationEPSS 0.4%CVE-2025-26565HIGHWordPress GNUPress Plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25041MEDIUMIBM Cognos Analytics cross-site scriptingEPSS 0.4%CVE-2020-22402MEDIUMCross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reaEPSS 0.4%CVE-2025-0339MEDIUMcode-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scriptingEPSS 0.4%CVE-2025-6126MEDIUMPHPGurukul Rail Pass Management System contact.php cross site scriptingEPSS 0.4%CVE-2024-53967MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-1123HIGHSolid Mail – SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.4%