Weaknesses of type CWE-79

30,217 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-7902MEDIUMyangzongzhuan RuoYi SysNoticeController.java addSave cross site scriptingEPSS 0.3%CVE-2025-26588HIGHWordPress TTT Crop Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28889HIGHWordPress Custom Product Stickers for Woocommerce plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7543HIGHBreakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action DetailsEPSS 0.3%CVE-2025-26589HIGHWordPress IE CSS3 Support Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3320MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.3%CVE-2024-50580MEDIUMIn JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleEPSS 0.3%CVE-2025-31563HIGHWordPress AI Search Bar plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11382MEDIUMCommon Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11333MEDIUMHLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28924HIGHWordPress ZenphotoPress plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7534HIGHSUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' ParameterEPSS 0.3%CVE-2024-10636MEDIUMQuiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via contentEPSS 0.3%CVE-2026-8141HIGHAjax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' FieldEPSS 0.3%CVE-2024-2324MEDIUMFileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-10180MEDIUMMarkdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-13847MEDIUMPhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-28890HIGHWordPress Lightview Plus plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26879HIGHWordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50582MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsEPSS 0.3%