Weaknesses of type CWE-79

29,810 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-47449HIGHWordPress Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37975HIGHWordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-33368MEDIUMZimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST intEPSS 0.4%CVE-2023-32236HIGHWordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-31076HIGHWordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47146HIGHWordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-36686HIGHWordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-31094HIGHWordPress Stock Sync for WooCommerce Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27455HIGHWordPress Update Image Tag Alt Attribute Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28784HIGHWordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37873HIGHWordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-35775HIGHWordPress WP Backup Manager Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45005HIGHWordPress Seriously Simple Stats Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-50740MEDIUMA missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileEPSS 0.4%CVE-2023-47545MEDIUMWordPress Forms for Mailchimp by Optin Cat Plugin <= 2.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37977HIGHWordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-49397CRITICALCross-site Scripting in Elvaco M-Bus Metering Gateway CMe3100EPSS 0.4%CVE-2022-46858HIGHWordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33312HIGHWordPress Easy Captcha Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45003HIGHWordPress Social Feed Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%