Weaknesses of type CWE-79

29,641 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-2954MEDIUMCross-site Scripting (XSS) - Stored in liangliangyy/djangoblogEPSS 0.4%CVE-2023-47654MEDIUMWordPress BZScore – Live Score Plugin <= 1.03 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-47999MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-51067MEDIUMAn unauthenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackerEPSS 0.4%CVE-2024-54315MEDIUMWordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-3189MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8154MEDIUMSourceCodester QR Code Bookmark System Parameter update-bookmark.php cross site scriptingEPSS 0.4%CVE-2025-2196MEDIUMMRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scriptingEPSS 0.4%CVE-2026-34658MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-45640MEDIUMWordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49745MEDIUMWordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-1597MEDIUMSourceCodester Best Church Management Software redirect.php cross site scriptingEPSS 0.4%CVE-2024-54264HIGHWordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-33515MEDIUMSoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.EPSS 0.4%CVE-2026-8351MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' ParameterEPSS 0.4%CVE-2026-15662MEDIUMAdvanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' ParameterEPSS 0.4%CVE-2025-32492MEDIUMWordPress Admin Menu Post List plugin <= 2.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-54276MEDIUMWordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-17089MEDIUMEvents Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' ParameterEPSS 0.4%CVE-2024-34421MEDIUMWordPress BlogLentor – Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%