Weaknesses of type CWE-79

30,147 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-51370MEDIUMWordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-24399CRITICALChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input ExecutionEPSS 0.3%CVE-2024-46409MEDIUMA stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injectingEPSS 0.3%CVE-2024-1434MEDIUMWordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-49258MEDIUMReflected cross-site scripting vulnerabilityEPSS 0.3%CVE-2023-46824MEDIUMWordPress Slick Popup Plugin <= 1.7.14 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-32593MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.3.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23501MEDIUMWordPress Ebook Store Plugin <= 5.788 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-57857MEDIUMFlow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message ParameterEPSS 0.3%CVE-2024-29804MEDIUMWordPress Fancy Comments WordPress plugin <= 1.2.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56259MEDIUMWordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51548MEDIUMWordPress SlickNav Mobile Menu Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-11490MEDIUM115cms set.html cross site scriptingEPSS 0.3%CVE-2024-30185MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27996MEDIUMWordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-50924HIGHStored XSS in Overview and Output fieldsEPSS 0.3%CVE-2023-51691MEDIUMWordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2022-27545MEDIUMHCL BigFix Web Reports authorized users may perform HTML injection.EPSS 0.3%CVE-2024-29807MEDIUMWordPress DearFlip plugin <= 2.2.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9448MEDIUMcode-projects Employee Management System applyleave.php cross site scriptingEPSS 0.3%