Weaknesses of type CWE-79

29,818 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-12348MEDIUMGuizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scriptingEPSS 0.4%CVE-2024-46655MEDIUMA reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a usEPSS 0.4%CVE-2024-51827MEDIUMWordPress Boombox Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-7015MEDIUMMaxSite CMS Guestbook Plugin cross site scriptingEPSS 0.4%CVE-2024-51828MEDIUMWordPress Beacon For Help Scout plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50554MEDIUMWordPress Sided plugin <= 1.4.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50538MEDIUMWordPress Show Visitor IP Address plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-51824MEDIUMWordPress Advanced Video Player with Analytics plugin <= 1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2021-47857MEDIUMMoodle 3.10.3 - 'label' Persistent Cross Site ScriptingEPSS 0.4%CVE-2025-53692HIGHSitecore Experience Platform Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-92385MEDIUMSourceCodester Online Food Ordering System Category Update update_category.php cross site scriptingEPSS 0.4%CVE-2025-6698MEDIUMLabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross site scriptingEPSS 0.4%CVE-2025-6695MEDIUMLabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross site scriptingEPSS 0.4%CVE-2024-10185MEDIUMStreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed ShortcodeEPSS 0.4%CVE-2024-30441HIGHWordPress Combo Blocks plugin <= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30537MEDIUMWordPress Upload Quota per User plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-11891MEDIUMPerfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-30539MEDIUMWordPress BMo Expo plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-68147HIGHopensourcepos has a Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2024-10184MEDIUMSW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed ShortcodeEPSS 0.4%