Weaknesses of type CWE-79

29,810 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-34184HIGHWordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40196HIGHWordPress ImageRecycle pdf & image compression Plugin <= 3.1.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28535HIGHWordPress Paytm Payment Donation Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28693HIGHWordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30747HIGHWordPress WooCommerce Easy Duplicate Product Plugin <= 0.3.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30753HIGHWordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-35043HIGHWordPress Recent Posts Slider Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40205HIGHWordPress PixTypes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45065HIGHWordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 1.42 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32511HIGHWordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33332HIGHWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25412MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP_SERVER_LISTEPSS 0.4%CVE-2023-28992HIGHWordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-31072HIGHWordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28166HIGHWordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6957MEDIUMFluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-33325HIGHWordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30781HIGHWordPress Tweeple Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28776HIGHWordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30483HIGHWordPress Watu Quiz Plugin <= 3.3.9.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%