Weaknesses of type CWE-79

29,827 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-90569MEDIUMlinlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scriptingEPSS 0.4%CVE-2025-31762MEDIUMWordPress Sheet2Site plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31804MEDIUMWordPress Follow Us Badges plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31733MEDIUMWordPress WP Sitemap Plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26747MEDIUMWordPress RainbowNews theme <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-6495HIGHAjax Load More < 7.8.4 - Reflected XSSEPSS 0.4%CVE-2025-31730MEDIUMWordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31740MEDIUMWordPress News, Magazine and Blog Elements Plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-46571MEDIUMOpen WebUI vulnerable to limited stored XSS vila uploaded html fileEPSS 0.4%CVE-2026-93975MEDIUMcode-projects Assessment Management User Editing edit-user.php cross site scriptingEPSS 0.4%CVE-2026-14655MEDIUMcode-projects Assessment Management view-users.php cross site scriptingEPSS 0.4%CVE-2025-30818MEDIUMWordPress jAlbum Bridge plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-71503MEDIUMDolibarr < 24.0.0 Reflected XSS via Extra Fields Administration TemplateEPSS 0.4%CVE-2025-31778MEDIUMWordPress Donate Me Plugin <= 1.2.5 - Stored Cross-Site Scripting vulnerabilityEPSS 0.4%CVE-2025-24595MEDIUMWordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-15532MEDIUMSourceCodester Online Book Store System User Management cross site scriptingEPSS 0.4%CVE-2025-32640MEDIUMWordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-40184MEDIUMStored Cross Site Scripting (XSS) in VIDEOJET multi 4000EPSS 0.4%CVE-2023-50371MEDIUMWordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-31747MEDIUMWordPress WP Chrono plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%