Weaknesses of type CWE-79

29,799 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-47229MEDIUMWordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-2337HIGHRefleccted XSS on Plunet BusinessManagerEPSS 0.4%CVE-2023-4779MEDIUMUser Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-4745MEDIUMcode-projects Employee Record System current_employees.php cross site scriptingEPSS 0.4%CVE-2023-23707MEDIUMWordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-45712LOWSolarWinds Serv-U Client-Side Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2022-45817MEDIUMWordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-43938HIGHYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderEPSS 0.4%CVE-2023-26954MEDIUMonekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.EPSS 0.4%CVE-2022-40699MEDIUMWordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-42474MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web IntelligenceEPSS 0.4%CVE-2024-24812MEDIUMFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesEPSS 0.4%CVE-2023-49828MEDIUMWordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-11707CRITICALMultiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application ManagerEPSS 0.4%CVE-2024-6588MEDIUMPowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url ParameterEPSS 0.4%CVE-2024-45513MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/EPSS 0.4%CVE-2023-31860MEDIUMWuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.EPSS 0.4%CVE-2026-11712CRITICALIBM WebSphere Application Server is affected by a cross-site scripting vulnerabilityEPSS 0.4%CVE-2025-41425HIGHDuraComm DP-10iN-100-MU Cross-site ScriptingEPSS 0.4%CVE-2026-39335MEDIUMChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsEPSS 0.4%