Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56261MEDIUMWordPress Project Showcase plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4451MEDIUMColibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player ShortcodeEPSS 0.3%CVE-2024-9066MEDIUMMarketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-82646MEDIUMWWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.phpEPSS 0.3%CVE-2024-37432MEDIUMWordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9418MEDIUMcode-projects Employee Management System changepassemp.php cross site scriptingEPSS 0.3%CVE-2025-9746MEDIUMCampcodes Hospital Management System Edit Doctor Specialization edit-doctor-specialization.php cross site scriptingEPSS 0.3%CVE-2024-4042MEDIUMPost Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributeEPSS 0.3%CVE-2024-4208MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer EffectEPSS 0.3%CVE-2024-7144MEDIUMJetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-97322MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scriptingEPSS 0.3%CVE-2026-82868MEDIUM@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVGEPSS 0.3%CVE-2023-6495MEDIUMYARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site ScriptingEPSS 0.3%CVE-2024-9074MEDIUMAdvanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-13559MEDIUMTemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-5061MEDIUMEnfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class ParametersEPSS 0.3%CVE-2024-34795MEDIUMWordPress Tainacan plugin <= 0.21.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7046MEDIUMPortfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSEPSS 0.3%CVE-2024-37922MEDIUMWordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5332MEDIUMExclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card WidgetEPSS 0.3%