Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-44180MEDIUMPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.EPSS 0.3%CVE-2026-58035NONEStored XSS through a system message in the codex version of Special:BlockEPSS 0.3%CVE-2024-51762HIGHWordPress PropertyShift plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51693HIGHWordPress Search order by product SKU for WooCommerce plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51695HIGHWordPress Fabrica Synced Pattern Instances plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51706HIGHWordPress UW Freelancer plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47300HIGHWordPress CubeWP Forms plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49308HIGHWordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13659MEDIUMListamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-5383MEDIUMYifang CMS Article Management Module cross site scriptingEPSS 0.3%CVE-2026-58034NONEStored XSS through a system message when blocking a temporary account that's related to other temporary accountsEPSS 0.3%CVE-2024-56223HIGHWordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49912MEDIUMWordPress Email Subscription Popup plugin <= 1.2.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46827HIGHGraylog Allows Session Takeover via Insufficient HTML SanitizationEPSS 0.3%CVE-2026-28871MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4EPSS 0.3%CVE-2025-12269MEDIUMLearnHouse Account Setting previews cross site scriptingEPSS 0.3%CVE-2023-28148HIGHA bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.EPSS 0.3%CVE-2024-51711HIGHWordPress Saragna plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47500MEDIUMWordPress Stackable plugin <= 3.19.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-45751MEDIUMSourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the FullnamEPSS 0.3%