Weaknesses of type CWE-79

29,693 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-32183MEDIUMWordPress Video Playlist For YouTube plugin <= 6.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-23878HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-43418MEDIUMGLPI has multiple reflected XSSEPSS 0.4%CVE-2025-32197MEDIUMWordPress Piotnet Addons For Elementor plugin <= 2.4.36 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.4%CVE-2024-27994HIGHWordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-2087MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2024-30199HIGHWordPress WP-Lister Lite for Amazon plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-34961MEDIUMChamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.EPSS 0.4%CVE-2023-1197MEDIUMCross-site Scripting (XSS) - Stored in uvdesk/community-skeletonEPSS 0.4%CVE-2023-39971—Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2024-9502MEDIUMMaster Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip ModuleEPSS 0.4%CVE-2023-5357MEDIUMInstagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-34582MEDIUMSunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature.EPSS 0.4%CVE-2024-29094HIGHWordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-111232MEDIUMNetgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator ColorEPSS 0.4%CVE-2026-52725MEDIUMAngular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)EPSS 0.4%CVE-2025-4325MEDIUMMRCMS Category Management Page add.do cross site scriptingEPSS 0.4%CVE-2023-24027MEDIUMIn MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.EPSS 0.4%CVE-2024-23884HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%