Weaknesses of type CWE-79

29,881 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3551MEDIUMCustom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' SettingEPSS 0.4%CVE-2025-10272MEDIUMerjinzhi 10OA catalogue cross site scriptingEPSS 0.4%CVE-2023-23709MEDIUMWordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23699MEDIUMWordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23826MEDIUMWordPress Add Posts to Pages Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23642MEDIUMWordPress Sidebar-Content from Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11765MEDIUMWordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-23873MEDIUMWordPress BBSpoiler Plugin <= 2.01 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-2086MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2024-9657MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-22532MEDIUMWordPress Simple Photo Sphere plugin <= 0.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-27619MEDIUMWordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-32951MEDIUMio.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST APIEPSS 0.4%CVE-2024-11875MEDIUMAdd infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-45812MEDIUMWordPress Exxp Plugin <= 2.6.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-22511MEDIUMWordPress Slides & Presentations Plugin <= 0.0.39 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23817MEDIUMWordPress Simple PDF Viewer Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-22546MEDIUMWordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-37994MEDIUMWordPress Art Decoration Shortcode Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27443MEDIUMWordPress Simple Vimeo Shortcode Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%