Weaknesses of type CWE-79

29,116 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-25062MEDIUMWordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-29452LOWWordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-36282MEDIUMWordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.5%CVE-2026-87793MEDIUMReflected XSS in WordPress theme design-scuole-wordpress-themeEPSS 0.5%CVE-2025-5806HIGHJenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introducEPSS 0.5%CVE-2023-5291MEDIUMBlog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46848MEDIUMWordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-4772MEDIUMNewsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-84293HIGHRepeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field ValuesEPSS 0.5%CVE-2023-5062MEDIUMWordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-27918MEDIUMCross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remoteEPSS 0.5%CVE-2026-83561HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexEPSS 0.5%CVE-2023-44855MEDIUMCross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a craftedEPSS 0.5%CVE-2023-22296MEDIUMReflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAEPSS 0.5%CVE-2026-8901HIGHIntegration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission DataEPSS 0.5%CVE-2026-77233HIGHiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex RewriteEPSS 0.5%CVE-2023-20119MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as CoEPSS 0.5%CVE-2024-7752MEDIUMSourceCodester Clinics Patient Management System update_medicine.php cross site scriptingEPSS 0.5%CVE-2026-6177HIGHCustom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet TextEPSS 0.5%