Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47392MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-33025MEDIUMxArrow SCADA Path TraversalEPSS 0.3%CVE-2024-12112MEDIUMEasy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-50440MEDIUMWordPress CodePen Embedded Pens Shortcode plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9826HIGHStored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution fEPSS 0.3%CVE-2024-38705MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47357MEDIUMWordPress Happy Addons for Elementor plugin <= 3.12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35681MEDIUMWordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-40719MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.3%CVE-2024-47364MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35707MEDIUMWordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8607MEDIUMmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode AttributeEPSS 0.3%CVE-2024-45457MEDIUMWordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35639MEDIUMWordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-60454MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image manaEPSS 0.3%CVE-2024-43329MEDIUMWordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53441MEDIUMJenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of EPSS 0.3%CVE-2025-60453MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column manEPSS 0.3%CVE-2026-2481MEDIUMBeaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'EPSS 0.3%CVE-2026-6740MEDIUMNexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block AttributeEPSS 0.3%