Weaknesses of type CWE-79

29,760 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-28330MEDIUMSolarWinds Observability Self-Hosted Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-25035HIGHJalios JPlatform 10 Multiple Cross-Site Scripting (XSS)EPSS 0.4%CVE-2022-44582MEDIUMWordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23674MEDIUMWordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8917MEDIUMAnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-23995MEDIUMWordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-42069MEDIUMOnline Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability.EPSS 0.4%CVE-2023-28533MEDIUMWordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-26989MEDIUMLibreNMS has Stored XSS in Alert RuleEPSS 0.4%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.4%CVE-2023-24383MEDIUMWordPress Namaste! LMS Plugin <= 2.5.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-20386MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reEPSS 0.4%CVE-2024-8668MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-24396MEDIUMWordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44266MEDIUMWordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11459MEDIUMCountry Blocker <= 3.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-47170MEDIUMWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-22679MEDIUMWordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25793MEDIUMWordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44239MEDIUMWordPress WWM Social Share On Image Hover Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%