Weaknesses of type CWE-79

29,990 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-45479MEDIUMXSS in Yordam Library Automation SystemEPSS 0.4%CVE-2026-30864HIGHCombodo iTop: Reflected XSS in dashboard revertEPSS 0.4%CVE-2026-5162MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed WidgetEPSS 0.4%CVE-2023-1840MEDIUMSp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-0817HIGHFormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-32145HIGHWordPress WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.4%CVE-2023-51488HIGHWordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-32138HIGHWordPress Short URL plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33537MEDIUMWordPress WP Portfolio theme <= 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29766MEDIUMWordPress StreamWeasels Twitch Integration plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2864HIGHWordPress Youzify - Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-22550MEDIUMWordPress AddFunc Mobile Detect plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29799MEDIUMWordPress WP Fast Total Search plugin <= 1.59.211 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29797MEDIUMWordPress Grid Shortcodes plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-30451MEDIUMWordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-8847MEDIUMyangzongzhuan RuoYi edit cross site scriptingEPSS 0.4%CVE-2025-46270MEDIUMA reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. A speEPSS 0.4%CVE-2025-55887MEDIUMCross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GEPSS 0.4%CVE-2023-51540HIGHWordPress Custom 404 Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-102755MEDIUMDataEase Datasource/Dataset Folder Name Stored Cross-Site ScriptingEPSS 0.4%