Weaknesses of type CWE-79

30,217 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-26879HIGHWordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10180MEDIUMMarkdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-0219MEDIUMTrimble SPS851 Receiver Status Identity Tab cross site scriptingEPSS 0.3%CVE-2026-40457LOWReflected XSS in LMSEPSS 0.3%CVE-2024-11761MEDIUMLegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-70596MEDIUMGhost: Cross-Site Scripting in Feature Image CaptionsEPSS 0.3%CVE-2024-36140HIGHA vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devicesEPSS 0.3%CVE-2025-28934HIGHWordPress Simple Post Series plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1511MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-11382MEDIUMCommon Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-6186HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-31548HIGHWordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11383MEDIUMCC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-31563HIGHWordPress AI Search Bar plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3320MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.3%CVE-2025-28903HIGHWordPress Driving Directions plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7902MEDIUMyangzongzhuan RuoYi SysNoticeController.java addSave cross site scriptingEPSS 0.3%CVE-2025-22997MEDIUMA stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers EPSS 0.3%CVE-2024-10636MEDIUMQuiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via contentEPSS 0.3%CVE-2025-24722MEDIUMWordPress FAQ Builder AYS Plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%