Weaknesses of type CWE-79

30,203 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47301HIGHWordPress Bit Form plugin <= 2.13.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47327HIGHWordPress GEO my WP plugin <= 4.5.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-45007MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. TEPSS 0.3%CVE-2024-32556MEDIUMWordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32579MEDIUMWordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47326HIGHWordPress Share This Image plugin <= 2.01 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1521MEDIUMElementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File UploadEPSS 0.3%CVE-2024-47348HIGHWordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32530MEDIUMWordPress Simple Testimonials Showcase plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3309MEDIUMQi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widgetEPSS 0.3%CVE-2024-2249MEDIUMLA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-38682MEDIUMWordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38679MEDIUMWordPress Animated Typed JS Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2781MEDIUMElementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tagEPSS 0.3%CVE-2024-47380HIGHWordPress WP-Lister Lite for eBay plugin <= 3.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1048MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.3%CVE-2024-6450MEDIUMReflected XSS in HyperView Geoportal ToolkitEPSS 0.3%CVE-2024-33640MEDIUMWordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24871MEDIUMWordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27990MEDIUMWordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%