Weaknesses of type CWE-79

30,042 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-0738MEDIUMShortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' ShortcodeEPSS 0.3%CVE-2025-8544MEDIUMPortabilis i-Educar edit cross site scriptingEPSS 0.3%CVE-2024-5892MEDIUMDivi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2024-12445MEDIUMRightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11775MEDIUMParticle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-30763MEDIUMWordPress EO4WP plugin <= 1.0.8.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-12528MEDIUMWordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12443MEDIUMCRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32601HIGHWordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11877MEDIUMCricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32600HIGHWordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-31407MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Business Planning and ConsolidationEPSS 0.3%CVE-2024-5024MEDIUMMemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key ParametersEPSS 0.3%CVE-2021-47914MEDIUMPHP Melody 3.0 Persistent XSS Vulnerability via Edit Video ParameterEPSS 0.3%CVE-2024-6374MEDIUMlahirudanushka School Management System Subject Page subject.php cross site scriptingEPSS 0.3%CVE-2023-24525MEDIUMSAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in CroEPSS 0.3%CVE-2024-56252MEDIUMWordPress Enter Addons plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-86898MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, viEPSS 0.3%CVE-2025-22752HIGHWordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56254MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%