Weaknesses of type CWE-79

30,217 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-75091HIGHQuill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-6518MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-6186HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-28899HIGHWordPress WP Event Ticketing plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2482MEDIUMGotcha | Gesture-based Captcha <= 1.0.0 - Reflected Cross-Site Scripting via menu ParameterEPSS 0.3%CVE-2025-31568HIGHWordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28911HIGHWordPress Gravity 2 PDF plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25648HIGHTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File UploadEPSS 0.3%CVE-2025-28921HIGHWordPress SpatialMatch IDX plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4256MEDIUMSeaCMS admin_paylog.php cross site scriptingEPSS 0.3%CVE-2024-12166MEDIUMShortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'EPSS 0.3%CVE-2025-28877HIGHWordPress Key4ce osTicket Bridge plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28917HIGHWordPress Custom Smilies plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26914HIGHWordPress Variable Inspector plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6520MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-18595HIGHWP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler RequestEPSS 0.3%CVE-2025-53608MEDIUMAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForEPSS 0.3%CVE-2024-10320MEDIUMCookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay ShortcodeEPSS 0.3%CVE-2026-55793MEDIUMCraft CMS: Stored XSS via Structure entry title in table viewEPSS 0.3%CVE-2025-31571HIGHWordPress The Logo Slider plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%