Weaknesses of type CWE-79

30,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-3100MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-11733HIGHFootnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-11995HIGHCommunity Events <= 1.5.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23825MEDIUMWordPress Easy Shortcode Buttons plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32586MEDIUMWordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-55279MEDIUMUguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files.EPSS 0.3%CVE-2021-27917HIGHXSS in contact tracking and page hits reportEPSS 0.3%CVE-2025-45315MEDIUMA cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitraryEPSS 0.3%CVE-2025-25144HIGHWordPress Theasys plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-49679MEDIUMWordPress WPKoi Templates for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32505MEDIUMWordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22748MEDIUMWordPress SetMore Theme – Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23031MEDIUMCross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIAEPSS 0.3%CVE-2023-42230MEDIUMPat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function.EPSS 0.3%CVE-2026-45616MEDIUMVvveb: Stored XSS in Posts allows privilege escalation via post editorEPSS 0.3%CVE-2025-43006MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)EPSS 0.3%CVE-2026-83591HIGHAMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex TransformationEPSS 0.3%CVE-2026-96667HIGHReal Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.3%CVE-2026-4005MEDIUMCoachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode AttributeEPSS 0.3%CVE-2024-32527MEDIUMWordPress Jotform Online Forms plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%