Weaknesses of type CWE-79

30,235 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-30196MEDIUMJenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` schemeEPSS 0.3%CVE-2025-23588HIGHWordPress WOW Best CSS Compiler plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59669MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2024-5125HIGHXSS and Open Redirect via SVG File Upload in parisneo/lollms-webuiEPSS 0.3%CVE-2025-23030MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'cadastro_funcionario.php' parameter 'cpf' in WeGIAEPSS 0.3%CVE-2024-35760MEDIUMWordPress WP Job Portal plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3869MEDIUM4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37959MEDIUMWordPress Power BI Embedded for WordPress plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6050MEDIUMStored Cross-Site Scripting (XSS) in Mezzanine CMS Admin InterfaceEPSS 0.3%CVE-2025-3275MEDIUMThemesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-10876MEDIUMXSS in Talent Software's e-BapEPSS 0.3%CVE-2025-24707HIGHWordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-107631HIGHRecord of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' ParameterEPSS 0.3%CVE-2025-3870MEDIUM1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-35768MEDIUMWordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41709MEDIUMBackdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.EPSS 0.3%CVE-2026-117645MEDIUMPhoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1EPSS 0.3%CVE-2024-13340MEDIUMMDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23582HIGHWordPress Bulk Categories Assign plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31199HIGHA “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently injecEPSS 0.3%