Weaknesses of type CWE-79

29,540 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3320MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.4%CVE-2024-54358HIGHWordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8541MEDIUMDiscount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-44205MEDIUMFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image UploadEPSS 0.4%CVE-2026-65763MEDIUMJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4EPSS 0.4%CVE-2026-55081HIGHDHIS2 Reflected XSS in OpenAPI HTML scope parameterEPSS 0.4%CVE-2026-40282MEDIUMWeGIA has stored XSS in intercorrencia_visualizar.phpEPSS 0.4%CVE-2023-4962MEDIUMVideo PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-54275HIGHWordPress CSV to html plugin <= 3.08 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-29420MEDIUMWordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-29052MEDIUMUsers were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. AttackEPSS 0.4%CVE-2026-47739MEDIUMFrappe: Stored XSS in NoteEPSS 0.4%CVE-2026-53758HIGHEmlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not SanitizedEPSS 0.4%CVE-2026-78073MEDIUMJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0EPSS 0.4%CVE-2026-5010MEDIUMReflected Cross-Site Scripting (XSS) in Sanoma’s ClickeduEPSS 0.4%CVE-2024-23887HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-4747HIGHWordPress Propovoice CRM plugin <= 1.7.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12000MEDIUMcode-projects Blood Bank System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2024-54305HIGHWordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54235HIGHWordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%