Weaknesses of type CWE-79

29,503 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-34430MEDIUMWordPress TT Custom Post Type Creator plugin <=1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-27621MEDIUMWordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-34173MEDIUMWordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34420MEDIUMWordPress Comments Evolved for WordPress plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-26527MEDIUMWordPress Debug Assistant Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34426MEDIUMWordPress Brozzme Scroll Top plugin <= 1.8.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-53599CRITICALWhale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.EPSS 0.4%CVE-2023-35092MEDIUMWordPress breadcrumb simple Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-13589MEDIUMOtsuka Information Technology｜FMS - Reflected Cross-site ScriptingEPSS 0.4%CVE-2023-34372MEDIUMWordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-0893MEDIUMTime Sheets < 1.29.3 - Admin+ Stored XSSEPSS 0.4%CVE-2023-1021MEDIUMAmr Ical Events Lists <= 6.6 - Admin+ Stored XSSEPSS 0.4%CVE-2023-1649MEDIUMChatBot < 4.5.1 - Admin+ Stored XSSEPSS 0.4%CVE-2024-6130MEDIUMForm Maker by 10Web < 1.15.26 - Admin+ Stored XSSEPSS 0.4%CVE-2024-7709MEDIUMOcoMon URL require_access_recovery.php cross site scriptingEPSS 0.4%CVE-2024-11850MEDIUMStored XSS in langgenius/difyEPSS 0.4%CVE-2023-20201MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPSS 0.4%CVE-2023-24397MEDIUMWordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-1746MEDIUMTestimonial Slider < 2.3.8 - Admin+ Stored XSSEPSS 0.4%CVE-2025-49407HIGHWordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%