Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-9104MEDIUMDraft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post TitleEPSS 0.4%CVE-2026-33406MEDIUMPi-hole has a Stored HTML attribute injectionEPSS 0.4%CVE-2024-3731MEDIUMCustomer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'EPSS 0.4%CVE-2023-40560MEDIUMWordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44987MEDIUMWordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39162HIGHWordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39992HIGHWordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6828HIGHARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_urlEPSS 0.4%CVE-2024-25573MEDIUMStored Cross-Site Scripting in Administrative Console ContextEPSS 0.4%CVE-2024-38274MEDIUMmoodle: stored XSS via calendar's event title when deleting the eventEPSS 0.4%CVE-2023-49747MEDIUMWordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40604MEDIUMWordPress Cookies by JM Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-27512MEDIUMTenda F3 Reflected Script Execution via Missing nosniff HeaderEPSS 0.4%CVE-2023-40552MEDIUMWordPress Fitness calculators plugin Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2082HIGHEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-24771MEDIUMHono has a Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2024-51419MEDIUMCross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a EPSS 0.4%CVE-2024-53365MEDIUMA stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.phpEPSS 0.4%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.4%CVE-2023-6527MEDIUMEmail Subscription Popup <= 1.2.18 - Reflected Cross-Site ScriptingEPSS 0.4%