Weaknesses of type CWE-79

29,777 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-35097HIGHWordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27378HIGHBIG-IP TMUI XSS vulnerabilityEPSS 0.4%CVE-2023-51299MEDIUMPHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugiEPSS 0.4%CVE-2023-30471HIGHWordPress WP Search Analytics Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23876MEDIUMWordPress wpDataTables Plugin <= 2.1.49 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47187MEDIUMFile upload XSS vulnerability in Generex CS141EPSS 0.4%CVE-2023-28490HIGHWordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24408MEDIUMWordPress Ecwid Shopping Cart Plugin <= 6.11.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-29720MEDIUMSofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.EPSS 0.4%CVE-2025-3692MEDIUMSourceCodester Online Eyewear Shop Master.php cross site scriptingEPSS 0.4%CVE-2024-11462MEDIUMFilestack Official <= 2.1.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-40663HIGHWordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23880MEDIUMWordPress ExactMetrics Plugin <= 7.14.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32600MEDIUMWordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-13501MEDIUMWP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-4406MEDIUMGravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterEPSS 0.4%CVE-2024-3208MEDIUMSydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable GalleryEPSS 0.4%CVE-2023-40601HIGHWordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23874MEDIUMWordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24400MEDIUMWordPress Cookie Notice & Compliance for GDPR / CCPA Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%