Weaknesses of type CWE-79

29,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-24529MEDIUMAn issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.EPSS 0.4%CVE-2024-33953MEDIUMWordPress Adventure Journal theme <= 1.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33951MEDIUMWordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-17089MEDIUMEvents Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' ParameterEPSS 0.4%CVE-2025-32489MEDIUMWordPress Wetterwarner plugin <= 2.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-12932MEDIUMcode-projects Simple Admin Panel addSizeController.php cross site scriptingEPSS 0.4%CVE-2025-32488MEDIUMWordPress Aria Font plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-34415MEDIUMWordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33952MEDIUMWordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-5293MEDIUM診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' ParameterEPSS 0.4%CVE-2025-32129MEDIUMWordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-50136MEDIUMCross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new cuEPSS 0.4%CVE-2024-34441MEDIUMWordPress Easy Affiliate Links plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-13704MEDIUMGiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa FormEPSS 0.4%CVE-2024-37879MEDIUMImproper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrEPSS 0.4%CVE-2025-5508MEDIUMTOTOLINK A3002RU IP Port Filtering Page cross site scriptingEPSS 0.4%CVE-2024-54276MEDIUMWordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-15421MEDIUMSpeed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag AttributesEPSS 0.4%CVE-2025-5122MEDIUMMap Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url ParameterEPSS 0.4%CVE-2023-27414HIGHWordPress Popup box Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%