Weaknesses of type CWE-79

29,810 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-0916HIGHYaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-0753HIGHSuper Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' ParameterEPSS 0.4%CVE-2023-29172HIGHWordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25428MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via openvpn_usersEPSS 0.4%CVE-2024-8108MEDIUMShare This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment ParameterEPSS 0.4%CVE-2023-32800HIGHWordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-32258HIGHWinter: Stored XSS through Editor Settings custom stylesEPSS 0.4%CVE-2023-27432HIGHWordPress Manage Upload Limit Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30473HIGHWordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45071HIGHWordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28781HIGHWordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47441HIGHWordPress Charitable Plugin <= 1.7.0.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-34176HIGHWordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32106HIGHWordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47433HIGHWordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30877HIGHWordPress XML for Google Merchant Center Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37981HIGHWordPress Authors List Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-31071HIGHWordPress Modal Dialog Plugin <= 3.5.14 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32503HIGHWordPress GTmetrix for WordPress Plugin <= 0.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30494HIGHWordPress ImageRecycle pdf & image compression Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%