Weaknesses of type CWE-79

29,814 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13397MEDIUMWPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11974MEDIUMMedia Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action ParametersEPSS 0.4%CVE-2024-8786MEDIUMAuto Featured Image from Title <= 2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-70486HIGHOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2026-15306MEDIUMProduct Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search ParameterEPSS 0.4%CVE-2026-4246MEDIUMElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' ParameterEPSS 0.4%CVE-2022-44631MEDIUMWordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.4%CVE-2026-75586MEDIUMUnlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' ParameterEPSS 0.4%CVE-2023-23878MEDIUMWordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-43461MEDIUMWordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23700HIGHWordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13396MEDIUMFrictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-50745MEDIUMA missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did EPSS 0.4%CVE-2026-90981MEDIUMNewsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' ParameterEPSS 0.4%CVE-2025-23696HIGHWordPress Staging CDN plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25551MEDIUMCross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code EPSS 0.4%CVE-2026-4394MEDIUMGravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldEPSS 0.4%CVE-2026-34557CRITICALCI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2024-43370HIGHgettext.js vulnerable to cross-site scripting (XSS)EPSS 0.4%