Weaknesses of type CWE-79

29,716 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-47662MEDIUMWordPress Live Gold Price & Silver Price Charts Widgets Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-15094MEDIUMsunkaifei FlyCMS User Login UserController.java userLogin cross site scriptingEPSS 0.4%CVE-2024-32528HIGHWordPress WP Dynamic Keywords Injector plugin <= 2.3.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-47657MEDIUMWordPress Direct Checkout – Quick View – Buy Now For WooCommerce Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12628MEDIUMbodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-34563CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSEPSS 0.4%CVE-2024-10710LOWYaDisk Files <= 1.2.5 - Admin+ Stored XSSEPSS 0.4%CVE-2023-47245MEDIUMWordPress ANAC XML Viewer Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-92106LOWlazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSEPSS 0.4%CVE-2024-31971MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arEPSS 0.4%CVE-2023-43999MEDIUMAn issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acEPSS 0.4%CVE-2024-24800HIGHWordPress Product Feed PRO for WooCommerce plugin <= 13.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-30123MEDIUMwuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.EPSS 0.4%CVE-2024-47617MEDIUMReflected XSS Vulnerability in Sulu Media BundleEPSS 0.4%CVE-2025-36577MEDIUMDell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site SEPSS 0.4%CVE-2023-3476LOWSimplePHPscripts GuestBook Script URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2023-25963MEDIUMWordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29919HIGHWordPress Photo Gallery by Ays Plugin <=5.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8140MEDIUMSourceCodester Task Progress Tracker update-task.php cross site scriptingEPSS 0.4%CVE-2023-3477LOWRocketSoft Rocket LMS Contact Form store cross site scriptingEPSS 0.4%