Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-37898HIGHSafe mode Cross-site Scripting (XSS) vulnerability in JoplinEPSS 0.4%CVE-2025-31394HIGHWordPress More Mime Type Filters plugin <= 0.3 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2025-32537HIGHWordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56082LOWChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML setEPSS 0.4%CVE-2024-12374MEDIUMStored XSS in automatic1111/stable-diffusion-webuiEPSS 0.4%CVE-2024-23643MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed FormEPSS 0.4%CVE-2025-31379HIGHWordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32581HIGHWordPress WordPress Spam Blocker Plugin <= 2.0.5 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2024-30503HIGHWordPress Mailster plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8648MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-32337MEDIUMA cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or EPSS 0.4%CVE-2025-32523HIGHWordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-4431MEDIUMLA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2024-23818MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers FormatEPSS 0.4%CVE-2024-9267MEDIUMEasy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2024-37308MEDIUMWordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-32539HIGHWordPress WooCommerce – Store Exporter plugin <= 2.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6770HIGHLifetime free Drag & Drop Contact Form Builder for WordPress VForm <= 2.1.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-32525HIGHWordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-43372MEDIUMEmlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.EPSS 0.4%