Weaknesses of type CWE-79

29,693 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-6841MEDIUMReflected XSS in Request TrackerEPSS 0.4%CVE-2024-22288HIGHWordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-91127HIGHFile Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererEPSS 0.4%CVE-2024-10879MEDIUMForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-44851MEDIUMA stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web sEPSS 0.4%CVE-2019-25411MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCPEPSS 0.4%CVE-2022-45179MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todEPSS 0.4%CVE-2023-44229MEDIUMWordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45607MEDIUMWordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29923HIGHWordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-91165LOWWarpgate: Markup injection in SSO form_post return page via unencoded redirect/error valuesEPSS 0.4%CVE-2023-40677MEDIUMWordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-32149HIGHWordPress Jobs for WordPress plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.4%CVE-2024-29915HIGHWordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-56672HIGHComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type SanitizationEPSS 0.4%CVE-2020-37087MEDIUMEasy Transfer 1.7 for iOS - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2023-24514MEDIUMStored Cross Site Scripting Vulnerability in Visual Console ModuleEPSS 0.4%CVE-2019-25418MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via fwgroupsEPSS 0.4%CVE-2024-27952HIGHWordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%