Weaknesses of type CWE-79

30,294 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-32774MEDIUMVulnogram - Stored Cross-Site Scripting via Comment HypertextEPSS 0.3%CVE-2024-49239HIGHWordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59666MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2025-12546MEDIUMLogicalDOC Community Edition API Key creation UI cross site scriptingEPSS 0.3%CVE-2025-44180MEDIUMPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.EPSS 0.3%CVE-2025-5843MEDIUMBrandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-48095MEDIUMWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47352HIGHWordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51713HIGHWordPress HQ60 Fidelity Card plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28871MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4EPSS 0.3%CVE-2026-58035NONEStored XSS through a system message in the codex version of Special:BlockEPSS 0.3%CVE-2024-51778HIGHWordPress Satisfaction Reports from Help Scout plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49308HIGHWordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51760HIGHWordPress Dashing Memberships plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25371MEDIUMOPNsense 19.1 Reflected XSS via diag_ping.phpEPSS 0.3%CVE-2025-30599MEDIUMWordPress WP Parallax Content Slider plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52794MEDIUMMagnific lightbox susceptible to Cross-site Scripting in DiscourseEPSS 0.3%CVE-2024-51762HIGHWordPress PropertyShift plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56223HIGHWordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-45751MEDIUMSourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the FullnamEPSS 0.3%