Weaknesses of type CWE-79

29,778 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-22913MEDIUMImproper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction ofEPSS 0.4%CVE-2023-23874MEDIUMWordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9851MEDIUMLSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-24408MEDIUMWordPress Ecwid Shopping Cart Plugin <= 6.11.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49191MEDIUMWordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49195MEDIUMWordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-13403MEDIUMWPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML ParameterEPSS 0.4%CVE-2024-12841MEDIUMEmlog Pro tag.php cross site scriptingEPSS 0.4%CVE-2025-51534HIGHA cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitraryEPSS 0.4%CVE-2026-15664HIGHQuill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' ValueEPSS 0.4%CVE-2024-8718MEDIUMGravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-33997HIGHWordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49188MEDIUMWordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-12560MEDIUMEditorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' FieldEPSS 0.4%CVE-2022-43458MEDIUMWordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32659MEDIUMSUBNET PowerSYSTEM Center Cross-site ScriptingEPSS 0.4%CVE-2024-9435MEDIUMShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-26318MEDIUMSerenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.EPSS 0.4%CVE-2023-23668MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49841MEDIUMWordPress Optin Forms Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%