Weaknesses of type CWE-79

29,829 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-26739MEDIUMWordPress newseqo theme <= 2.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31165MEDIUMCross Site Scripting in NightWolf Penetration PlatformEPSS 0.4%CVE-2024-11873MEDIUMglomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-4682MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel WidgetsEPSS 0.4%CVE-2025-24610MEDIUMWordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6028MEDIUMSDM Web interface vulnerable to XSSEPSS 0.4%CVE-2024-12271MEDIUM360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-31829MEDIUMWordPress ShopCred plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24702MEDIUMWordPress Xagio SEO plugin <= 7.0.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12506MEDIUMNACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-36796MEDIUMWordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2025-26537MEDIUMWordPress GDPR Tools plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-88867CRITICALWWBN AVideo Stored XSS via Category Name and Icon ClassEPSS 0.4%CVE-2024-51853MEDIUMWordPress Faltu Testimonial Rotator plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-89256CRITICALAVideo Bookmark Plugin Stored XSS via Chapter NamesEPSS 0.4%CVE-2026-87811HIGHSiYuan before v3.8.2 Stored XSS via notebook template pathsEPSS 0.4%CVE-2024-29473MEDIUMOneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.EPSS 0.4%CVE-2025-5153MEDIUMCMS Made Simple Design Manager Module cross site scriptingEPSS 0.4%CVE-2024-43369HIGHPersistent Cross-site Scripting in Ibexa RichText Field TypeEPSS 0.4%CVE-2024-51825MEDIUMWordPress Alert Me! plugin <= 0.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%