Weaknesses of type CWE-79

29,750 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-23718MEDIUMWordPress Page Loading Effects Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23821MEDIUMWordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9220MEDIUMLH Copy Media File <= 1.08 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-44262MEDIUMWordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25972MEDIUMWordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25553MEDIUM A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE enEPSS 0.4%CVE-2023-24386MEDIUMWordPress AI Contact Us Form Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-29817LOWIn JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleEPSS 0.4%CVE-2024-9228MEDIUMLoggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-23673MEDIUMWordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47589MEDIUMWordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2020-18132MEDIUMCross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEEPSS 0.4%CVE-2023-23998MEDIUMWordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23981MEDIUMWordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-26528MEDIUMWordPress Shipyaari Shipping Management Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9209MEDIUMWP Search Analytics <= 1.4.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-25974MEDIUMWordPress wp2syslog Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44265MEDIUMWordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-46178MEDIUMCross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote EPSS 0.4%CVE-2022-44742MEDIUMWordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%