Weaknesses of type CWE-79

29,810 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-30754HIGHWordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39164HIGHWordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-4860MEDIUMThe 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lacEPSS 0.4%CVE-2023-24392HIGHWordPress Full Width Banner Slider Wp Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-4474MEDIUMitsourcecode University Management System admin_single_student_update.php cross site scriptingEPSS 0.4%CVE-2023-41663HIGHWordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49174MEDIUMWordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37893HIGHWordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-29385HIGHWordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-55958MEDIUMNorthern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.EPSS 0.4%CVE-2023-34012HIGHWordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-4100MEDIUMMultiple vulnerabilities in IDM Sistemas QSigeEPSS 0.4%CVE-2023-24420HIGHWordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-32257HIGHWinter: Stored XSS through Brand Settings custom stylesEPSS 0.4%CVE-2025-25092HIGHWordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2025-23535HIGHWordPress REAL WordPress Sidebar plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-53968MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-26566HIGHWordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50575MEDIUMIn JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APIEPSS 0.4%