Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-67833MEDIUMPaessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter.EPSS 0.3%CVE-2024-51662MEDIUMWordPress Black Widgets For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51588MEDIUMWordPress Super Addons for Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51581MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-78252HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-56029HIGHWordPress Easy Language Switcher plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51599MEDIUMWordPress Simple Business Manager plugin <= 4.6.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-87761HIGHAdwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up SettingsEPSS 0.3%CVE-2024-35711MEDIUMWordPress Event theme <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49233MEDIUMWordPress MAS Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49225MEDIUMWordPress wpPricing Builder plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0321MEDIUMElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-35731MEDIUMWordPress Kenta Gutenberg Blocks plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-23819HIGHError in SSID Processing allows Stored XSS in Web Management InterfaceEPSS 0.3%CVE-2024-56027HIGHWordPress Leads CRM plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50449MEDIUMWordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-58030MEDIUMSyntaxHighlight stored XSS via unsanitized 'linelinks' attributeEPSS 0.3%CVE-2025-11962HIGHStored XSS in DivvyDrive Information Technologies' Digital Corporate WarehouseEPSS 0.3%CVE-2025-8295MEDIUMEmployee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterEPSS 0.3%CVE-2024-49241MEDIUMWordPress Tito plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%