Weaknesses of type CWE-79

30,097 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-50951MEDIUMWiFi File Transfer 1.0.8 Persistent XSS via Web Server Input ValidationEPSS 0.3%CVE-2024-28730MEDIUMCross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attackeEPSS 0.3%CVE-2024-32833MEDIUMWordPress List Custom Taxonomy Widget plugin <= 4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33630MEDIUMWordPress Piotnet Addons For Elementor plugin <= 2.4.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47908MEDIUMUltimate POS 4.4 Persistent Cross-Site Scripting via Product NameEPSS 0.3%CVE-2024-30553MEDIUMWordPress WP Twitter Mega Fan Box Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31089MEDIUMWordPress Platinum SEO plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29936MEDIUMWordPress Image Hover Effects – Elementor Addon plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32539MEDIUMWordPress WP File Download Light plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33540MEDIUMWordPress ColorNews theme <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32079MEDIUMWordPress Advanced iFrame plugin <= 2024.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-96877MEDIUMReflected XSS through Cargo Drilldown full-text searchEPSS 0.3%CVE-2024-29914MEDIUMWordPress Stratum – Elementor Widgets plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32722MEDIUMWordPress Coupon & Discount Code Reveal Button plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31102MEDIUMWordPress Prenotazioni plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51878MEDIUMWordPress AchillesTheme-shortcodes plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51908MEDIUMWordPress Adventure Bucket List plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32707MEDIUMWordPress Image Slider plugin <= 1.1.125 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6539MEDIUMVoltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2026-96876MEDIUMAnonymous reflected XSS in CargoExport invalid-alias errorsEPSS 0.3%