Weaknesses of type CWE-79

30,092 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-3387MEDIUMrenrenio renren-security JSON cross site scriptingEPSS 0.3%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30436MEDIUMWordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29134MEDIUMWordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5425MEDIUMWP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title AttributeEPSS 0.3%CVE-2024-2289MEDIUMPowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element linkEPSS 0.3%CVE-2024-2936MEDIUMSydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _idEPSS 0.3%CVE-2024-56409HIGHPhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php fileEPSS 0.3%CVE-2025-0483MEDIUMFanli2012 native-php-cms jump.php cross site scriptingEPSS 0.3%CVE-2024-3890MEDIUMHappy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly WidgetEPSS 0.3%CVE-2023-32122MEDIUMWordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-0506MEDIUMRise Blocks – A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag ParameterEPSS 0.3%CVE-2024-12240MEDIUMPage Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label ParameterEPSS 0.3%CVE-2024-22146MEDIUMWordPress Schema & Structured Data for WP & AMP Plugin <= 1.25 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-31117MEDIUMWordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4316MEDIUMEmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-2491MEDIUMPowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*EPSS 0.3%CVE-2024-25936MEDIUMWordPress SoundCloud Shortcode plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1209MEDIUMcode-projects Wazifa System search_resualts.php searchuser cross site scriptingEPSS 0.3%CVE-2024-1759MEDIUMWP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%