Weaknesses of type CWE-79

29,828 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-31761MEDIUMWordPress Hypotext plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31815MEDIUMWordPress Design Blocks plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-45740MEDIUMPersistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk EnterpriseEPSS 0.4%CVE-2025-31783MEDIUMWordPress Leartes TRY Exchange Rates Plugin <= 2.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30776MEDIUMWordPress Sitekit plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-31847MEDIUMWordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-64828MEDIUMFroiden TableTrack 1.3.10 Stored XSS via Order Notes FieldEPSS 0.4%CVE-2025-2072MEDIUMReflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUIEPSS 0.4%CVE-2025-31754MEDIUMWordPress DobsonDev Shortcodes plugin <= 2.1.12 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31803MEDIUMWordPress Turisbook Booking System plugin <= 1.3.8 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30812MEDIUMWordPress SKT Addons for Elementor plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-10182MEDIUMCognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2024-7130MEDIUMReflected XSS in Kion Computer's KION Exchange Programs SoftwareEPSS 0.4%CVE-2026-94016MEDIUMSourceCodester Drug Recommendation System add_symptom cross site scriptingEPSS 0.4%CVE-2024-58296MEDIUMCE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.phpEPSS 0.4%CVE-2025-31749MEDIUMWordPress HMH Footer Builder For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30768MEDIUMWordPress jAlbum Bridge plugin <= 2.0.18 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-30766MEDIUMWordPress Happy Addons for Elementor plugin <= 3.16.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-31731MEDIUMWordPress Author Bio Shortcode Plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-78172MEDIUMThemify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site ScriptingEPSS 0.4%