Weaknesses of type CWE-79

29,878 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-9432MEDIUMmtons mblog Admin Panel list cross site scriptingEPSS 0.4%CVE-2024-11327MEDIUMClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-2195MEDIUMMRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scriptingEPSS 0.4%CVE-2025-22602MEDIUMStored DOM-based XSS (without CSP) via video placeholders in DiscourseEPSS 0.4%CVE-2024-11720HIGHFrontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-87812HIGHSiYuan before v3.8.2 Stored XSS via Bazaar iconURLEPSS 0.4%CVE-2023-41728MEDIUMWordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23703MEDIUMWordPress Arconix Shortcodes Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2020-37014MEDIUMTryton 5.4 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2023-40197MEDIUMWordPress flowpaper Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-22549MEDIUMWordPress WP Github plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11766MEDIUMWordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-41687MEDIUMWordPress Goods Catalog Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-76325HIGHStored Cross-Site Scripting (XSS) through Splunk Web in Splunk EnterpriseEPSS 0.4%CVE-2025-22554MEDIUMWordPress Video Embed Optimizer plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-25982MEDIUMWordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-45818MEDIUMWordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23826MEDIUMWordPress Add Posts to Pages Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-22515MEDIUMWordPress Show Google Analytics widget plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-74999MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.EPSS 0.4%