Weaknesses of type CWE-79

29,785 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-32341MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts oEPSS 0.4%CVE-2024-2794MEDIUMGutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-32957MEDIUMWordPress Team Members Showcase Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-12560MEDIUMEditorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' FieldEPSS 0.4%CVE-2024-12841MEDIUMEmlog Pro tag.php cross site scriptingEPSS 0.4%CVE-2023-49188MEDIUMWordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49191MEDIUMWordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49195MEDIUMWordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44743MEDIUMWordPress Jobs for WordPress Plugin <= 2.5.11.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2021-47844MEDIUMXmind 2020 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2023-33997HIGHWordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11820MEDIUMcode-projects Crud Operation System add.php cross site scriptingEPSS 0.4%CVE-2023-49841MEDIUMWordPress Optin Forms Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23668MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9353MEDIUMPopularis Extra <= 1.2.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9210MEDIUMMC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-8712MEDIUMGTM Server Side <= 2.1.19 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-46088MEDIUMOnline Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form.EPSS 0.4%CVE-2025-14046HIGHInsufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsEPSS 0.4%CVE-2022-40603MEDIUMA cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firEPSS 0.4%