Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-35169MEDIUMWordPress All Bootstrap Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-38354HIGHCross-site Scripting in Hackmd.io Notes lead by HTML InjectionEPSS 0.4%CVE-2025-4852MEDIUMTOTOLINK A3002R VPN Page cross site scriptingEPSS 0.4%CVE-2024-1537MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data TableEPSS 0.4%CVE-2024-54142CRITICALCross-site Scripting via Discourse-ai SharedAiConversation onebox in DiscourseEPSS 0.4%CVE-2023-4667HIGHStored Cross Site Scripting in webserver administrationEPSS 0.4%CVE-2024-29774HIGHWordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33554HIGHWordPress XStore Core plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-3327MEDIUMAuthenticated DatoCMS Web Previews Plugin Iframe InjectionEPSS 0.4%CVE-2023-23708MEDIUMWordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-42560MEDIUMA cross-site scripting (XSS) vulnerability in the component update_page_details.php of Blood Bank And Donation Management System commit dc9eEPSS 0.4%CVE-2024-29759HIGHWordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6288MEDIUMConversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-47610MEDIUMWordPress Simple Image Popup Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2020-36865MEDIUMNagios XI < 5.7.2 XSS via BPI Config ManagementEPSS 0.4%CVE-2024-4636MEDIUMImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2026-26719MEDIUMCross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET requesEPSS 0.4%CVE-2025-11183MEDIUMCross-Site Scripting Vulnerability in QWC2EPSS 0.4%CVE-2020-36866MEDIUMNagios XI < 5.7.3 XSS via Manage Users in Admin InterfaceEPSS 0.4%CVE-2022-50584MEDIUMNagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion FlowsEPSS 0.4%