Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-36359MEDIUMA cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to esEPSS 0.4%CVE-2024-41519MEDIUMFeripro <= v2.2.3 is vulnerable to Cross Site Scripting (XSS) via "/admin/programm/<program_id>/zuordnung/veranstaltungen/<event_id>" througEPSS 0.4%CVE-2025-31510HIGHIn the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (intEPSS 0.4%CVE-2024-27999HIGHWordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-28002HIGHWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8727MEDIUMDK PDF <= 1.9.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%CVE-2024-13669MEDIUMCalendApp <= 1.1 - Reflected XSSEPSS 0.4%CVE-2024-29758HIGHWordPress Co-marquage service-public.fr plugin <= 0.5.72 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-38255MEDIUMSocomec MOD3GP-SY-120K Cross-site ScriptingEPSS 0.4%CVE-2024-9232MEDIUMDownload Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-24879HIGHWordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-28001HIGHWordPress Favicon Rotator plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-21154MEDIUMVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported veEPSS 0.4%CVE-2023-32241HIGHWordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49175MEDIUMWordPress KP Fastest Tawk.to Chat Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30867MEDIUMWordPress SearchIQ plugin <= 4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-40329MEDIUMWordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39162HIGHWordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40552MEDIUMWordPress Fitness calculators plugin Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%