Weaknesses of type CWE-79

30,317 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-53741MEDIUMWordPress Simple Popup plugin <= 4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-58394MEDIUMOPNsense: Stored XSS in Administration Settings via Certificate DescriptionEPSS 0.2%CVE-2026-118652MEDIUMEcho: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobEPSS 0.2%CVE-2025-56382MEDIUMA stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticatedEPSS 0.2%CVE-2024-53746MEDIUMWordPress Elementor Button Plus plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14991MEDIUMCampcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scriptingEPSS 0.2%CVE-2023-42245MEDIUMSelesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php.EPSS 0.2%CVE-2025-32427MEDIUMFormie has a XSS vulnerability for importing formsEPSS 0.2%CVE-2022-38075MEDIUMWordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)EPSS 0.2%CVE-2025-69096HIGHWordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15483MEDIUMLink Hopper <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' ParameterEPSS 0.2%CVE-2026-87780HIGHLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping RulesEPSS 0.2%CVE-2024-53743MEDIUMWordPress Countdown Timer for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-54025MEDIUMLibreChat: Stored XSS via unescaped image alt text in markdown artifact previewEPSS 0.2%CVE-2023-42250MEDIUMSelesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php.EPSS 0.2%CVE-2025-11828MEDIUMMagazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-53747MEDIUMWordPress Video Player for WPBakery plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4429MEDIUMOSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode AttributeEPSS 0.2%CVE-2026-54386MEDIUMmarimo < 0.23.9 XSS via file Query Parameter in assets.pyEPSS 0.2%CVE-2025-12118MEDIUMSchema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD SchemaEPSS 0.2%