Weaknesses of type CWE-79

29,772 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-47421MEDIUMWordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24522MEDIUMDue to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenEPSS 0.4%CVE-2025-23695HIGHWordPress CtyGrid Hyp3rL0cal Search plugin <= 0.1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-3543LOWGZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scriptingEPSS 0.4%CVE-2024-11894MEDIUMThe Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-29471MEDIUMOneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.EPSS 0.4%CVE-2024-11278MEDIUMGD bbPress Attachments <= 4.7.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-51299MEDIUMPHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugiEPSS 0.4%CVE-2023-51300MEDIUMPHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_smEPSS 0.4%CVE-2024-8189MEDIUMWP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9060MEDIUMAVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-35097HIGHWordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41871HIGHWordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-38138HIGHBIG-IP Configuration utility vulnerabilityEPSS 0.4%CVE-2024-4709MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-29099MEDIUMWordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-3821MEDIUMSourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scriptingEPSS 0.4%CVE-2023-35098HIGHWordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27378HIGHBIG-IP TMUI XSS vulnerabilityEPSS 0.4%CVE-2023-40330HIGHWordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%