Weaknesses of type CWE-79

29,691 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-1278MEDIUMEasy Social Feed – Social Photos Gallery – Post Feed – Like Box <= 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-2212MEDIUMCastlenet CBW383G2N RgSwInfo.asp cross site scriptingEPSS 0.4%CVE-2024-53966MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-48060HIGHLitestar: HTML Injection Through CSRF TokenEPSS 0.4%CVE-2025-32183MEDIUMWordPress Video Playlist For YouTube plugin <= 6.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-45602HIGHWordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-39017HIGHXSS in all comments fields in M-Files HubshareEPSS 0.4%CVE-2023-32108HIGHWordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-23879HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23855HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2025-32190MEDIUMWordPress Musician's Pack For Elementor plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32170MEDIUMWordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-53801MEDIUMWordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31020MEDIUMWordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-32162MEDIUMWordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-32109HIGHWordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33984MEDIUMCross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)EPSS 0.4%CVE-2024-44796HIGHA cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to executEPSS 0.4%CVE-2023-32801HIGHWordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-51691MEDIUMCross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attackeEPSS 0.4%