Weaknesses of type CWE-79

29,817 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6882MEDIUMSimple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_modeEPSS 0.4%CVE-2026-92385MEDIUMSourceCodester Online Food Ordering System Category Update update_category.php cross site scriptingEPSS 0.4%CVE-2021-47857MEDIUMMoodle 3.10.3 - 'label' Persistent Cross Site ScriptingEPSS 0.4%CVE-2024-51816MEDIUMWordPress Banner System plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-48336MEDIUMWordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-48780MEDIUMWordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51827MEDIUMWordPress Boombox Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12348MEDIUMGuizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scriptingEPSS 0.4%CVE-2025-40644MEDIUMReflected Cross-Site Scripting (XSS) in QRGen's RiftzillaEPSS 0.4%CVE-2023-48289MEDIUMWordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50538MEDIUMWordPress Show Visitor IP Address plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-51828MEDIUMWordPress Beacon For Help Scout plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-1819HIGHStored XSS in Karel Electronics' ViPortEPSS 0.4%CVE-2026-7013MEDIUMMaxSite CMS mail_send Plugin cross site scriptingEPSS 0.4%CVE-2023-49179MEDIUMWordPress Event post Plugin <= 5.8.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9143MEDIUMScada-LTS mailing_lists.shtm cross site scriptingEPSS 0.4%CVE-2024-2948MEDIUMFavorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-50370MEDIUMWordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-46655MEDIUMA reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a usEPSS 0.4%CVE-2026-7012MEDIUMMaxSite CMS Redirect Plugin cross site scriptingEPSS 0.4%