Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-6495MEDIUMPremium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text WidgetEPSS 0.3%CVE-2025-32512HIGHWordPress Revamp CRM for WooCommerce plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32490HIGHWordPress wp secure plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-1645MEDIUMHostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL SettingEPSS 0.3%CVE-2025-40679MEDIUMHTML injection in Isshue from BdtaskEPSS 0.3%CVE-2026-104644MEDIUMImage Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration UpdateEPSS 0.3%CVE-2026-58475MEDIUMSustainable Irrigation Platform 5.2.16 Stored XSS via Program NameEPSS 0.3%CVE-2023-33528MEDIUMhalo v1.6.0 is vulnerable to Cross Site Scripting (XSS).EPSS 0.3%CVE-2026-1183MEDIUMHTML injection in multiple Botble productsEPSS 0.3%CVE-2023-53915MEDIUMZenphoto 1.6 Stored Cross-Site Scripting via Album DescriptionEPSS 0.3%CVE-2024-53459MEDIUMSysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter.EPSS 0.3%CVE-2026-105261MEDIUMPublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode AttributesEPSS 0.3%CVE-2025-32582HIGHWordPress WP AutoKeyword Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5290MEDIUMBorderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-3057MEDIUMDrupal core - Critical - Cross site scripting - SA-CORE-2025-001EPSS 0.3%CVE-2023-51485MEDIUMWordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-40179MEDIUMPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerEPSS 0.3%CVE-2024-25098MEDIUMWordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-42197HIGHRELATE Vulnerable to Stored XSS via Unprivileged User ProfileEPSS 0.3%CVE-2023-52193MEDIUMWordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%