Weaknesses of type CWE-79

29,799 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-36211MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-31445HIGHWordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49846MEDIUMWordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7304MEDIUMNinja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-49820MEDIUMWordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7302MEDIUMBlog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.4%CVE-2024-11110MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a EPSS 0.4%CVE-2024-6804MEDIUMJeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG FileEPSS 0.4%CVE-2024-36186MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-36208MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-47834MEDIUMWordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47850MEDIUMWordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-6208MEDIUMDownload Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-47231MEDIUMWordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30554HIGHWordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31078HIGHWordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32503HIGHWordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30778HIGHWordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-67855MEDIUMMooodle: mooodle: information disclosure and script execution via reflected cross-site scriptingEPSS 0.4%CVE-2024-5763MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%