Weaknesses of type CWE-79

30,134 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-4326MEDIUMMRCMS Add Fragment Page add.do cross site scriptingEPSS 0.3%CVE-2025-4324MEDIUMMRCMS External Link Management Page edit.do cross site scriptingEPSS 0.3%CVE-2024-31108MEDIUMWordPress iFlyChat plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-116796HIGHHighcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsEPSS 0.3%CVE-2024-11400MEDIUMHUSKY – Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax ParameterEPSS 0.3%CVE-2023-1726MEDIUMXSS in Proliz OBSEPSS 0.3%CVE-2025-4323MEDIUMMRCMS Edit Article Page cross site scriptingEPSS 0.3%CVE-2025-46865MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-30524MEDIUMWordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27996MEDIUMWordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51691MEDIUMWordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-1434MEDIUMWordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-50924HIGHStored XSS in Overview and Output fieldsEPSS 0.3%CVE-2024-29804MEDIUMWordPress Fancy Comments WordPress plugin <= 1.2.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12393MEDIUMDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003EPSS 0.3%CVE-2023-51370MEDIUMWordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-30185MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46409MEDIUMA stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injectingEPSS 0.3%CVE-2024-10049MEDIUMEdit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via pageEPSS 0.3%CVE-2026-9518MEDIUMhemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scriptingEPSS 0.3%