Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-32524HIGHWordPress MyWorks WooCommerce Sync for QuickBooks Online plugin <= 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-37308MEDIUMWordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-11753MEDIUMUMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4431MEDIUMLA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2024-9267MEDIUMEasy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2024-3266MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL AttributeEPSS 0.4%CVE-2024-23818MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers FormatEPSS 0.4%CVE-2024-11102MEDIUMSourceCodester Hospital Management System edit-doc.php cross site scriptingEPSS 0.4%CVE-2024-29777HIGHWordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32525HIGHWordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-58305HIGHWonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module InstallationEPSS 0.4%CVE-2025-32517HIGHWordPress MultiMailer plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13157MEDIUMMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS FeedEPSS 0.4%CVE-2025-32538HIGHWordPress Easy Post Duplicator Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-27517MEDIUMWebasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permiEPSS 0.4%CVE-2024-5368MEDIUMKashipara College Management System delete_faculty.php cross site scriptingEPSS 0.4%CVE-2025-32523HIGHWordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-31652MEDIUMA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.4%CVE-2024-23640MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style PublisherEPSS 0.4%CVE-2024-9667MEDIUMSeriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%