Weaknesses of type CWE-79

30,184 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11277MEDIUM404 Solution <= 2.35.19 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-9681MEDIUMO2OA Personal Profile agent cross site scriptingEPSS 0.3%CVE-2023-5988MEDIUMReflected XSS in Uyumsoft ERPEPSS 0.3%CVE-2026-10833MEDIUMGutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block AttributeEPSS 0.3%CVE-2024-29102HIGHWordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-109990HIGHFlying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2024-30552MEDIUMWordPress Responsive flipbook plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3129MEDIUMLiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag AttributesEPSS 0.3%CVE-2026-78054MEDIUMSourceCodester Class and Exam Timetabling System BSIS1.php cross site scriptingEPSS 0.3%CVE-2026-84438MEDIUMOpenCart Autocomplete Workflow edit.php cross site scriptingEPSS 0.3%CVE-2024-49633HIGHWordPress DirectoryPress plugin <= 3.6.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-53919MEDIUMPodcastGenerator Stored Cross-Site Scripting via Freebox Content FieldEPSS 0.3%CVE-2026-29192HIGHZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverEPSS 0.3%CVE-2026-7436MEDIUMWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' AttributeEPSS 0.3%CVE-2025-2513MEDIUMSmart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-24927HIGHWordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-35656HIGHWordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4559MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode AttributeEPSS 0.3%CVE-2024-33947HIGHWordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26984HIGHWordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%