Weaknesses of type CWE-79

30,038 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-32586HIGHWordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11906MEDIUMTPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12527MEDIUMPerfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-23516MEDIUMWordPress CC BMI Calculator Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-5766MEDIUMLikeshop Merchandise admin cross site scriptingEPSS 0.3%CVE-2024-23514MEDIUMWordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-32599HIGHWordPress Task Scheduler Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13385MEDIUMJSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12443MEDIUMCRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11775MEDIUMParticle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5892MEDIUMDivi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2025-24638MEDIUMWordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8721MEDIUMTracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-51337MEDIUMPHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index.EPSS 0.3%CVE-2025-32600HIGHWordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2491MEDIUMDromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingEPSS 0.3%CVE-2024-11758MEDIUMWP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-8544MEDIUMPortabilis i-Educar edit cross site scriptingEPSS 0.3%CVE-2024-32981MEDIUMCross-site Scripting vulnerability with encoded payload in silverstripe/frameworkEPSS 0.3%CVE-2024-10340MEDIUMShortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%