Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56010HIGHWordPress Device Detector Plugin <= 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56069HIGHWordPress WP SuperBackup plugin <= 2.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7726MEDIUMThe7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description AttributesEPSS 0.3%CVE-2025-58324MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.EPSS 0.3%CVE-2024-56028HIGHWordPress Lemonade Social Networks Autoposter Pinterest plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34547MEDIUMWordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50471MEDIUMWordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-39107MEDIUMA Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitizEPSS 0.3%CVE-2024-49234MEDIUMWordPress Plexx Elementor Extension plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-60298MEDIUMNovel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint.EPSS 0.3%CVE-2025-48251MEDIUMWordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-37622MEDIUMXinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.EPSS 0.3%CVE-2024-51571MEDIUMWordPress MasterBip para Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-28063MEDIUMKiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.EPSS 0.3%CVE-2026-7014MEDIUMMaxSite CMS down_count Plugin cross site scriptingEPSS 0.3%CVE-2025-61539MEDIUMCross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.EPSS 0.3%CVE-2025-71432HIGHFrappe ERPNext before 15.83.0 Reflected XSS Leading to Account TakeoverEPSS 0.3%CVE-2024-54206MEDIUMWordPress Z-Downloads plugin <= 1.11.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13795MEDIUMcodingWithElias School Management System Edit Student Info student-view.php cross site scriptingEPSS 0.3%CVE-2024-9283MEDIUMRelaxedJS ReLaXed Pug to PDF Converter cross site scriptingEPSS 0.3%