Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-113487MEDIUMGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeEPSS 0.3%CVE-2026-3702MEDIUMSourceCodester Loan Management System index.php cross site scriptingEPSS 0.3%CVE-2024-3851MEDIUMUnrestricted File Upload Leading to XSS in imartinez/privategptEPSS 0.3%CVE-2024-46237MEDIUMPHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) via the patname, pataddress, and medhis parameters in EPSS 0.3%CVE-2024-27963MEDIUMWordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30544HIGHWordPress OK Poster Group plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-110524MEDIUMCopy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode AttributeEPSS 0.3%CVE-2024-8719MEDIUMFlexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-30848HIGHWordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37957MEDIUMWordPress Bradmax Player plugin <= 1.1.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22158MEDIUMWordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-2715MEDIUMtimschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scriptingEPSS 0.3%CVE-2024-11727MEDIUMNotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-22310MEDIUMWordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-45375CRITICALSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionEPSS 0.3%CVE-2024-10048MEDIUMPost Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via pageEPSS 0.3%CVE-2025-53932MEDIUMWeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro_adotante.php' parameter 'cpf'EPSS 0.3%CVE-2025-30520HIGHWordPress Breezing Forms plugin <= 1.2.8.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-25593MEDIUMWordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32508MEDIUMWordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%