Weaknesses of type CWE-79

29,800 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-46864HIGHWordPress Woocommerce Custom Checkout Fields Editor With Drag & Drop Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37894HIGHWordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28792HIGHWordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45771HIGHWordPress Contact Form With Captcha plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-33326HIGHWordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47600HIGHWordPress Mass Email To users Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37976HIGHWordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-66771MEDIUMCross Site Scripting (XSS) vulnerability in SAPUI5EPSS 0.4%CVE-2023-32499HIGHWordPress Radio Station Plugin <= 2.4.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41856HIGHWordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30481HIGHWordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25424MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via https_exceptionsEPSS 0.4%CVE-2023-41662HIGHWordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41867HIGHWordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33309HIGHWordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-22703HIGHWordPress WCP Contact Form Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28607MEDIUMjs/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.EPSS 0.4%CVE-2022-47590HIGHWordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-89243CRITICALWWBN AVideo Stored XSS via UserGroups setGroup_nameEPSS 0.4%CVE-2023-27450HIGHWordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%