Weaknesses of type CWE-79

30,094 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-6910MEDIUMBookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-37625MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.phpEPSS 0.3%CVE-2022-28975MEDIUMA stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML vEPSS 0.3%CVE-2024-8858MEDIUMElementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings ParameterEPSS 0.3%CVE-2026-75980MEDIUMBetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post ContentEPSS 0.3%CVE-2026-5924MEDIUMGetwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'EPSS 0.3%CVE-2024-13393MEDIUMVideo Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-13968MEDIUMStarboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2023-52188MEDIUMWordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-3002MEDIUMGutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple BlocksEPSS 0.3%CVE-2023-32497MEDIUMWordPress Block Referer Spam Plugin <= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-4868MEDIUMExtensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox WidgetEPSS 0.3%CVE-2026-4653MEDIUMBlock, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' ParameterEPSS 0.3%CVE-2025-3004MEDIUMSayski ForestBlog search cross site scriptingEPSS 0.3%CVE-2024-13386MEDIUMquote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-5399MEDIUMRedux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field ValueEPSS 0.3%CVE-2024-9897MEDIUMStreamWeasels Twitch Integration <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed ShortcodeEPSS 0.3%CVE-2026-15425MEDIUMYoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)EPSS 0.3%CVE-2025-8911MEDIUMWellChoose｜Organization Portal System - Reflected Cross-site ScriptingEPSS 0.3%CVE-2026-6972MEDIUMSKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%