Weaknesses of type CWE-79

29,751 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-47589MEDIUMWordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9865MEDIUMEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction LogEPSS 0.4%CVE-2022-44734MEDIUMWordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9209MEDIUMWP Search Analytics <= 1.4.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-94377HIGHVerified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)EPSS 0.4%CVE-2025-11282MEDIUMFrappe LMS Incomplete Fix CVE-2025-55006 cross site scriptingEPSS 0.4%CVE-2023-24386MEDIUMWordPress AI Contact Us Form Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25553MEDIUM A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE enEPSS 0.4%CVE-2026-75981HIGHTranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-23683MEDIUMWordPress White Label Branding for Elementor Page Builder Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7485HIGHTraffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2020-18132MEDIUMCross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEEPSS 0.4%CVE-2022-29817LOWIn JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleEPSS 0.4%CVE-2022-42462MEDIUMWordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9226MEDIUMLanding Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-25460MEDIUMWordPress Easy Ad Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23821MEDIUMWordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23673MEDIUMWordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23811MEDIUMWordPress Smoothscroller Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-26529MEDIUMWordPress DupeOff Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%