Weaknesses of type CWE-79

29,721 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-34563CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSEPSS 0.4%CVE-2023-41136MEDIUMWordPress Simple Long Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-5468MEDIUMSlick Contact Forms <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-15094MEDIUMsunkaifei FlyCMS User Login UserController.java userLogin cross site scriptingEPSS 0.4%CVE-2023-3476LOWSimplePHPscripts GuestBook Script URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2023-47511MEDIUMWordPress Pinyin Slugs Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23616HIGHWordPress Canalplan plugin <= 5.31 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23753HIGHWordPress DN Sitemap Control plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-102258MEDIUMPost-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) whEPSS 0.4%CVE-2025-26557HIGHWordPress ViperBar Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23879HIGHWordPress Easy Automatic Newsletter Lite Plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50516MEDIUMWordPress Countdown & Clock plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-28851MEDIUMSilverstripe Form Capture vulnerable to Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-23864MEDIUMWordPress Very Simple Google Maps Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23741HIGHWordPress Notifications Center plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-110625MEDIUMClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.phpEPSS 0.4%CVE-2025-23740HIGHWordPress Easy School Registration plugin <= 3.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49813HIGHWordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23498HIGHWordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24694HIGHWordPress CM Pop-Up Banners plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%