Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56037HIGHWordPress User Referral plugin <= 8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51597MEDIUMWordPress ThemeShark Templates & Widgets for Elementor plugin <= 1.1.7 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50470MEDIUMWordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51603MEDIUMWordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56267HIGHWordPress Interactive UK Map plugin <= 3.4.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56038HIGHWordPress SendSMS Plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48485MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2024-56060HIGHWordPress HTML Forms plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-41238MEDIUMDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackEPSS 0.3%CVE-2025-24966MEDIUMHTML Injection in reNgineEPSS 0.3%CVE-2025-13412MEDIUMCampcodes Retro Basketball Shoes Online Store admin_running.php cross site scriptingEPSS 0.3%CVE-2026-25004MEDIUMWordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51585MEDIUMWordPress Sales Page Addon plugin <= 1.4.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2016-20032MEDIUMZKTeco ZKAccess Security System 5.3.1 Stored XSSEPSS 0.3%CVE-2024-50501MEDIUMWordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54350HIGHWordPress hmd theme <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8315MEDIUMWP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterEPSS 0.3%CVE-2025-70959MEDIUMA stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripEPSS 0.3%CVE-2024-56032HIGHWordPress FV Descriptions plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49231MEDIUMWordPress WordPress Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%