Weaknesses of type CWE-79

30,185 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-29771MEDIUMWordPress Dracula Dark Mode plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34376MEDIUMWordPress Edge theme <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-16684MEDIUMEasy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact MethodEPSS 0.3%CVE-2026-15604MEDIUMToocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post MetaEPSS 0.3%CVE-2026-1382MEDIUMfresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode AttributesEPSS 0.3%CVE-2026-109990HIGHFlying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2026-8865MEDIUMAvalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-29143MEDIUMWordPress Passwordless Login plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-29192HIGHZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverEPSS 0.3%CVE-2024-24927HIGHWordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-13570MEDIUMSourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scriptingEPSS 0.3%CVE-2024-11277MEDIUM404 Solution <= 2.35.19 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-2513MEDIUMSmart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-41201CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2EPSS 0.3%CVE-2024-29096MEDIUMWordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-5988MEDIUMReflected XSS in Uyumsoft ERPEPSS 0.3%CVE-2026-15505MEDIUMvnotex vnote YAML Frontmatter markdownit.js cross site scriptingEPSS 0.3%CVE-2026-10833MEDIUMGutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block AttributeEPSS 0.3%CVE-2026-12154MEDIUMReviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode AttributeEPSS 0.3%CVE-2026-78054MEDIUMSourceCodester Class and Exam Timetabling System BSIS1.php cross site scriptingEPSS 0.3%