Weaknesses of type CWE-79

30,038 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11685MEDIUMKudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'EPSS 0.3%CVE-2025-30763MEDIUMWordPress EO4WP plugin <= 1.0.8.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-11884MEDIUMWp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24687MEDIUMWordPress Show/Hide Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12528MEDIUMWordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-48870MEDIUMSharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerabilityEPSS 0.3%CVE-2024-21036MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.3%CVE-2024-35766HIGHWordPress WPPizza – A Restaurant Plugin plugin <= 3.18.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-6697MEDIUMAn Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname paramEPSS 0.3%CVE-2025-12021MEDIUMWP-OAuth <= 0.4.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-23579MEDIUMWordPress DZS Ajaxer Lite plugin <= 1.04 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2374HIGHLogin No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELFEPSS 0.3%CVE-2026-0738MEDIUMShortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' ShortcodeEPSS 0.3%CVE-2024-9884MEDIUMT(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-9270MEDIUMLenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-25972MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEMEPSS 0.3%CVE-2024-11877MEDIUMCricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12519MEDIUMTCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11896MEDIUMText Prompter – Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32601HIGHWordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%