Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-35641MEDIUMWordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43123MEDIUMWordPress Card Elements for Elementor plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37528MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.3%CVE-2024-6701MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.EPSS 0.3%CVE-2026-29969MEDIUMA cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbiEPSS 0.3%CVE-2024-43226MEDIUMWordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-118648HIGHn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox PolicyEPSS 0.3%CVE-2024-37278MEDIUMWordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37215MEDIUMWordPress Transition Slider – Responsive Image Slider and Gallery plugin <= 2.20.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49261MEDIUMWordPress Arkhe Blocks plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49289MEDIUMWordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27469MEDIUMIsso: Stored XSS via comment website fieldEPSS 0.3%CVE-2025-8080MEDIUMAlobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2025-34259MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/buildingEPSS 0.3%CVE-2025-30928MEDIUMWordPress WP Biographia plugin <= 4.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-35642MEDIUMWordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42412MEDIUMCross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a userEPSS 0.3%CVE-2025-12230MEDIUMprojectworlds Expense Management System Currency create cross site scriptingEPSS 0.3%CVE-2024-34561MEDIUMWordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30930MEDIUMWordPress ACF: Yandex Maps Field plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%