Weaknesses of type CWE-79

29,962 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-95812MEDIUMClipBucket v5 before 5.5.3-#182 Reflected XSS via Query ParametersEPSS 0.4%CVE-2024-27987HIGHWordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24634MEDIUMWordPress Orbisius Simple Notice plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30575MEDIUMWordPress Login Redirect plugin <= - 1.0.5 Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-32544HIGHWordPress Netgsm plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54343HIGHWordPress Connect Contact Form 7 to Constant Contact plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26619MEDIUMVega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`EPSS 0.4%CVE-2024-31091HIGHWordPress Custom Field Bulk Editor plugin <= 1.9.1 - Cross Site Scripting vulnerabilityEPSS 0.4%CVE-2024-31112HIGHWordPress Convert Post Types plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56022HIGHWordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-22311HIGHWordPress Simply Schedule Appointments plugin <= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30792MEDIUMWordPress Comment Approved Notifier Extended plugin <= 5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54340HIGHWordPress Simple Presenter plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-35218MEDIUMUmbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview PaneEPSS 0.4%CVE-2024-4077HIGHWordPress UDesign theme <= 4.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-42686HIGHWordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11411MEDIUMSpotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12507MEDIUMOptio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-24658MEDIUMWordPress Auction Nudge – Your eBay on Your Site plugin <= 7.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-69606MEDIUMCross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gatewaysEPSS 0.4%