Weaknesses of type CWE-79

30,186 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11335MEDIUMUltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7729MEDIUMScada-LTS usersProfiles.shtm cross site scriptingEPSS 0.3%CVE-2024-13589MEDIUMYouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-102092HIGHKiteworks Core stored XSSEPSS 0.3%CVE-2024-35679HIGHWordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100313MEDIUMmathurvishal CloudClassroom-PHP-Project updatequery.php cross site scriptingEPSS 0.3%CVE-2023-44990MEDIUMWordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-112247MEDIUMWuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scriptingEPSS 0.3%CVE-2024-38858LOWCross-site scripting in Robotmk logs viewEPSS 0.3%CVE-2023-6047MEDIUMReflected XSS in Algoritim E-commerce SoftwareEPSS 0.3%CVE-2026-101127HIGHJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4EPSS 0.3%CVE-2024-24847HIGHWordPress CalculatorPro Calculators Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-13083MEDIUMPHPGurukul Land Record System admin-profile.php cross site scriptingEPSS 0.3%CVE-2025-2406HIGHXSS in Verisay Communication's TrizbiEPSS 0.3%CVE-2024-9545MEDIUMShortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps ShortcodesEPSS 0.3%CVE-2026-107627MEDIUMGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments BlockEPSS 0.3%CVE-2024-5664MEDIUMMP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer ShortcodeEPSS 0.3%CVE-2026-79799HIGHUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.3%CVE-2025-12739HIGHCross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseEPSS 0.3%CVE-2024-12320MEDIUMTeam Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'EPSS 0.3%