Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-28917HIGHWordPress Custom Smilies plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31568HIGHWordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3706MEDIUM104 Corporation eHRMS - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-50576MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestEPSS 0.3%CVE-2025-28882HIGHWordPress Omnify plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28911HIGHWordPress Gravity 2 PDF plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-19794HIGHWP-Stats <= 2.56 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28921HIGHWordPress SpatialMatch IDX plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6520MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-5842MEDIUMModern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class ParameterEPSS 0.3%CVE-2026-104901MEDIUMMISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked ServerEPSS 0.3%CVE-2025-4256MEDIUMSeaCMS admin_paylog.php cross site scriptingEPSS 0.3%CVE-2025-2124MEDIUMControl iD RH iD API change_password cross site scriptingEPSS 0.3%CVE-2024-22158MEDIUMWordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-53932MEDIUMWeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro_adotante.php' parameter 'cpf'EPSS 0.3%CVE-2026-113487MEDIUMGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeEPSS 0.3%CVE-2024-22302MEDIUMWordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25593MEDIUMWordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24712MEDIUMWordPress Heateor Social Login Plugin <= 1.1.30 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-30798HIGHWordPress Better WishList API plugin <= 1.1.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%