Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-44174MEDIUMOnline Movie Ticket Booking System v1.0 - Stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-6526MEDIUMMeta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-6982MEDIUMDisplay custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_dataEPSS 0.4%CVE-2026-92134HIGHJenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitteEPSS 0.4%CVE-2026-42840MEDIUMERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsEPSS 0.4%CVE-2023-47767HIGHWordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47773HIGHWordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47518HIGHWordPress Restrict Categories Plugin <= 2.6.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47766HIGHWordPress Post Status Notifier Lite Plugin <= 1.11.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23429HIGHWordPress Altima Lookbook Free for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-2768LOWSourceCodester Library Management System cross site scriptingEPSS 0.4%CVE-2021-24466—Verse-O-Matic <= 4.1.1 - CSRF to Stored XSSEPSS 0.4%CVE-2024-9323MEDIUMSourceCodester Inventory Management System add_staff.php cross site scriptingEPSS 0.4%CVE-2024-12982MEDIUMPHPGurukul Blood Bank & Donor Management System update-contactinfo.php cross site scriptingEPSS 0.4%CVE-2024-1679MEDIUMPrint Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via TemplatesEPSS 0.4%CVE-2023-47876HIGHWordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47509HIGHWordPress Edit WooCommerce Templates Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9433MEDIUMmtons mblog Admin Panel list cross site scriptingEPSS 0.4%CVE-2024-47812MEDIUMCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDumpEPSS 0.4%CVE-2023-48752HIGHWordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%