Weaknesses of type CWE-79

29,881 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-32103MEDIUMWordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-22516MEDIUMWordPress Metadata SEO plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-76325HIGHStored Cross-Site Scripting (XSS) through Splunk Web in Splunk EnterpriseEPSS 0.4%CVE-2023-41728MEDIUMWordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32239MEDIUMWordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41666MEDIUMWordPress Stock Quotes List Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-26530HIGHReflected XSS via question bank filterEPSS 0.4%CVE-2023-41687MEDIUMWordPress Goods Catalog Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-15948MEDIUMHydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.4%CVE-2025-10271MEDIUMerjinzhi 10OA finder cross site scriptingEPSS 0.4%CVE-2023-23862MEDIUMWordPress Vertical scroll recent post Plugin <= 14.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5088MEDIUMHappy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-25982MEDIUMWordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41248MEDIUMIn JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configurationEPSS 0.4%CVE-2025-22545MEDIUMWordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23831MEDIUMWordPress Rating Widget Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23701MEDIUMWordPress Easy Sign Up Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23664MEDIUMWordPress ConvertBox Auto Embed WordPress plugin Plugin <= 1.0.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23667MEDIUMWordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11808MEDIUMPingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site ScriptingEPSS 0.4%