Weaknesses of type CWE-79

29,760 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-23987MEDIUMWordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44742MEDIUMWordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-29817LOWIn JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleEPSS 0.4%CVE-2022-34148MEDIUMWordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23793MEDIUMWordPress Read More Without Refresh Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23673MEDIUMWordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23722MEDIUMWordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33213MEDIUMWordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23821MEDIUMWordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30874MEDIUMWordPress GPS Plotter Plugin <= 5.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30844HIGHWordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2023-23723MEDIUMWordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-22680MEDIUMWordPress No API Amazon Affiliate Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44625MEDIUMWordPress Cyklodev WP Notify Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8793MEDIUMStore Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-32206MEDIUMA stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute aEPSS 0.4%CVE-2023-23980MEDIUMWordPress MailOptin Plugin <= 1.2.54.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37523MEDIUMHCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tagsEPSS 0.4%CVE-2024-9240MEDIUMReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-6820HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email FieldEPSS 0.4%