Weaknesses of type CWE-79

29,800 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-45399MEDIUMIndico has a Cross-Site-Scripting during account creationEPSS 0.4%CVE-2024-9615MEDIUMBulkPress <= 0.3.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-13678MEDIUMR3W Instafeed <= 1.0 - Reflected XSSEPSS 0.4%CVE-2023-44477MEDIUMWordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-79418HIGHEMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper nEPSS 0.4%CVE-2024-9436MEDIUMPublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-23650MEDIUMWordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-45843MEDIUMWordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25061MEDIUMWordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-3560LOWGZ Scripts Ticket Booking Script load.php cross site scriptingEPSS 0.4%CVE-2023-24009MEDIUMWordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-29044MEDIUMDocuments operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operationEPSS 0.4%CVE-2023-44242MEDIUMWordPress Images Slideshow by 2J Plugin <= 1.3.54 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-42485MEDIUMWordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-7924MEDIUMPHPGurukul Online Banquet Booking System admin-profile.php cross site scriptingEPSS 0.4%CVE-2023-22712MEDIUMWordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-3559LOWGZ Scripts PHP GZ Appointment Scheduling Script load.php cross site scriptingEPSS 0.4%CVE-2024-9207MEDIUMBuddyPress Docs <= 2.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-49270MEDIUMHotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-29045MEDIUMDocuments operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could beEPSS 0.4%