Weaknesses of type CWE-79

30,269 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23447HIGHWordPress Smooth Dynamic Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20049HIGHDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site ScriptingEPSS 0.3%CVE-2024-12525MEDIUMEasy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9208MEDIUMEnable Accessibility <= 1.4.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-25118HIGHWordPress WPOptin plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25133HIGHWordPress WP Frontend Submit Plugin <= 1.1.0 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-22578MEDIUMWordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23450HIGHWordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5668MEDIUMLightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data AttributesEPSS 0.3%CVE-2024-13334MEDIUMCar Demon <= 1.8.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-31436HIGHWordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32118MEDIUMOpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation textEPSS 0.3%CVE-2024-36599MEDIUMA cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaEPSS 0.3%CVE-2025-23433HIGHWordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-106102CRITICALQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()EPSS 0.3%CVE-2025-24909MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2025-23464HIGHWordPress Twitter News Feed plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0757MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-108722LOWopen-computer-use through commit 610bac8 Stored XSS via log.html Session LogEPSS 0.3%CVE-2025-9856MEDIUMPopup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%