Weaknesses of type CWE-79

29,709 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-25774MEDIUMXSS in Notifications via saving DashboardsEPSS 0.4%CVE-2025-2340MEDIUMotale Tale Blog Site Settings save saveOptions cross site scriptingEPSS 0.4%CVE-2024-13696HIGHFlexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name ParameterEPSS 0.4%CVE-2023-5618MEDIUMModern Footnotes <= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-54386MEDIUMmarimo < 0.23.9 XSS via file Query Parameter in assets.pyEPSS 0.4%CVE-2024-32950HIGHWordPress WP Media Category Management plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-7029MEDIUMWordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2024-38669HIGHWordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-12300MEDIUMcode-projects Simple Food Ordering System addcategory.php cross site scriptingEPSS 0.4%CVE-2024-31107HIGHWordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-10605MEDIUMPortabilis i-Educar agenda_preferencias.php cross site scriptingEPSS 0.4%CVE-2025-34398MEDIUMMailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspxEPSS 0.4%CVE-2025-34401MEDIUMMailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspxEPSS 0.4%CVE-2024-21028MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.4%CVE-2024-21021MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.4%CVE-2025-12299MEDIUMcode-projects Simple Food Ordering System addproduct.php cross site scriptingEPSS 0.4%CVE-2024-12715MEDIUMAsgard Security Scanner <= 0.7 - Reflected XSSEPSS 0.4%CVE-2024-8787MEDIUMSmart Online Order for Clover <= 1.5.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-30267MEDIUMCLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.EPSS 0.4%CVE-2023-24026MEDIUMIn MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.EPSS 0.4%