Weaknesses of type CWE-79

29,656 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2925MEDIUMBeaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.4%CVE-2024-33424MEDIUMA cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML EPSS 0.4%CVE-2025-22335HIGHWordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-32339MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scriptsEPSS 0.4%CVE-2024-27680MEDIUMFlusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form."EPSS 0.4%CVE-2023-6747MEDIUMFooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-30496HIGHWordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-0691MEDIUMFileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder ImportEPSS 0.4%CVE-2026-54087HIGHEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldEPSS 0.4%CVE-2025-0175MEDIUMcode-projects Online Shop view.php cross site scriptingEPSS 0.4%CVE-2026-49978MEDIUMDOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentEPSS 0.4%CVE-2025-34425MEDIUMMailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspxEPSS 0.4%CVE-2024-0698MEDIUMEasy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-1357MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' ShortcodeEPSS 0.4%CVE-2025-22338HIGHWordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6387MEDIUMWP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url ParameterEPSS 0.4%CVE-2026-103904HIGHStored XSS Vulnerability in JTL-ShopEPSS 0.4%CVE-2023-49187HIGHWordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7300MEDIUMBolt CMS Showcase Creation showcases cross site scriptingEPSS 0.4%CVE-2023-1429MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.4%