Weaknesses of type CWE-79

29,800 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-27420HIGHWordPress Arya Multipurpose Theme <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25424MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via https_exceptionsEPSS 0.4%CVE-2023-32509HIGHWordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45006HIGHWordPress WooODT Lite Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33309HIGHWordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32499HIGHWordPress Radio Station Plugin <= 2.4.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41867HIGHWordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-22703HIGHWordPress WCP Contact Form Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32965HIGHWordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-84189CRITICALLibreNMS before 26.7.0 Stored XSS via Oxidized APIEPSS 0.4%CVE-2023-32518HIGHWordPress WP Chinese Conversion Plugin <= 1.1.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25961HIGHWordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28606MEDIUMjs/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.EPSS 0.4%CVE-2023-27613HIGHWordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30491HIGHWordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28792HIGHWordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27419HIGHWordPress Viable blog Theme <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-29100HIGHWordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-35772HIGHWordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45054HIGHWordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%