Weaknesses of type CWE-79

29,827 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11811MEDIUMFeedify – Web Push Notifications <= 2.4.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-47877MEDIUMWordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-17571MEDIUMFluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'EPSS 0.4%CVE-2025-24585MEDIUMWordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32493MEDIUMWordPress BP Social Connect plugin <= 1.6.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2023-28529MEDIUMIBM InfoSphere Information Server 11.7EPSS 0.4%CVE-2024-13023MEDIUMPHPGurukul Maid Hiring Management System Search Maid Page search-maid.php cross site scriptingEPSS 0.4%CVE-2025-31797MEDIUMWordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11755MEDIUMIMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-31734MEDIUMWordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24706MEDIUMWordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24704MEDIUMWordPress Magic the Gathering Card Tooltips plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-13015MEDIUMWP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' ParameterEPSS 0.4%CVE-2023-47786MEDIUMWordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-25115MEDIUMWordPress Like dislike plus counter plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31767MEDIUMWordPress Post Custom Templates Lite plugin <= 1.14 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-26723HIGHCross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to executeEPSS 0.4%CVE-2026-27210MEDIUMPannellum has a XSS vulnerability in hot spot attributesEPSS 0.4%CVE-2025-31849MEDIUMWordPress Nemesis All-in-One plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31812MEDIUMWordPress BuddyPress Members Only plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%