Weaknesses of type CWE-79

30,190 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-63528HIGHA cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. The applicatiEPSS 0.3%CVE-2024-51920MEDIUMWordPress Map Store Locator plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47078MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-57962MEDIUMWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37920HIGHWordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-57951MEDIUMWordPress SiteNarrator Text-to-Speech Widget Plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-35696HIGHWordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6494MEDIUMWPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-59895MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityEPSS 0.3%CVE-2025-5944MEDIUMElement Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption AttributeEPSS 0.3%CVE-2024-35687HIGHWordPress Link Library plugin <= 7.6.3 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23491HIGHWordPress VSTEMPLATE Creator plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-76704MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 0.3%CVE-2024-11779MEDIUMWIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2021-38119MEDIUMPossible Reflected Cross-Site Scripting (XSS) Vulnerability in OpenText iManagerEPSS 0.3%CVE-2025-7140MEDIUMSourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scriptingEPSS 0.3%CVE-2024-50438HIGHWordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12477MEDIUMGravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' ParameterEPSS 0.3%CVE-2026-59926MEDIUMMistune: XSS via unescaped class option in Admonition directiveEPSS 0.3%CVE-2024-39126MEDIUMRoundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.EPSS 0.3%