Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47387MEDIUMWordPress Search Atlas SEO plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-48046MEDIUMWordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12982MEDIUMDocument Gallery < 5.1.1 - Reflected XSS via dg_generate_galleryEPSS 0.3%CVE-2024-54451MEDIUMA cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7EPSS 0.3%CVE-2025-7110MEDIUMPortabilis i-Educar School Module educar_escola_lst.php cross site scriptingEPSS 0.3%CVE-2026-2292MEDIUMMorkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' FieldEPSS 0.3%CVE-2025-23057MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management InterfaceEPSS 0.3%CVE-2025-10642MEDIUMwangchenyi1996 chat_forum q.php cross site scriptingEPSS 0.3%CVE-2025-47593MEDIUMWordPress Really Simple Under Construction Page plugin <= 1.4.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-36147MEDIUMIBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.EPSS 0.3%CVE-2025-47522MEDIUMWordPress AWEOS WP Lock plugin <= 1.4.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-7111MEDIUMPortabilis i-Educar Course Module educar_curso_det.php cross site scriptingEPSS 0.3%CVE-2024-44037MEDIUMWordPress Multipurpose Ticket Booking Manager plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-36855MEDIUMWordPress Booking Ultra Pro plugin <= 1.1.4 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2026-1905MEDIUMSphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode AttributeEPSS 0.3%CVE-2025-30942MEDIUMWordPress Post Custom Templates Lite plugin <= 1.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-28989MEDIUMWordPress Read More Login plugin <= 2.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47605MEDIUMWordPress WP jQuery DataTable plugin <= 4.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-26001MEDIUMWordPress Next Event Calendar <= 1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-44035MEDIUMWordPress Gum Elementor Addon plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%