Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-44036MEDIUMWordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47376MEDIUMWordPress Slideshow Gallery LITE plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47340MEDIUMWordPress ComboBlocks plugin <= 2.2.89 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1649MEDIUMCommunity Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' ParameterEPSS 0.3%CVE-2025-51862MEDIUMInsecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. An attacker can exploiEPSS 0.3%CVE-2025-13048MEDIUMOfficial StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via NicknameEPSS 0.3%CVE-2024-44025MEDIUMWordPress NiceJob plugin < 3.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22312MEDIUMWordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30627MEDIUMWordPress Elegant Visitor Counter plugin <= 3.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-30637MEDIUMWordPress Booking Ultra Pro plugin <= 1.1.20 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-34797MEDIUMWordPress Simple Popup Manager plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38757MEDIUMWordPress Typebot plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13525MEDIUMWP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' ParameterEPSS 0.3%CVE-2024-49302MEDIUMWordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49318MEDIUMWordPress WPtouch plugin <= 4.3.60 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-47310MEDIUMWordPress ARI Fancy Lightbox -- Popup for WordPress plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37950MEDIUMWordPress Master Popups plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-88020MEDIUMImproper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3EPSS 0.3%CVE-2026-2277MEDIUMrexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' ParametersEPSS 0.3%CVE-2026-5255MEDIUMcode-projects Simple Laundry System Parameter delstaffinfo.php cross site scriptingEPSS 0.3%