Weaknesses of type CWE-79

30,204 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2031MEDIUMVideo Conferencing with Zoom <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-66300LOWSNOMED International Snowstorm reflected XSSEPSS 0.3%CVE-2024-32561MEDIUMWordPress Tagembed plugin <= 4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24871MEDIUMWordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32571MEDIUMWordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11052HIGHNinja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form CalculationsEPSS 0.3%CVE-2025-2204MEDIUMXSS in Tapandsign Technologies' Tap&Sign AppEPSS 0.3%CVE-2024-32552MEDIUMWordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38682MEDIUMWordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3732MEDIUMGeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' ShortcodeEPSS 0.3%CVE-2026-83946HIGHAzure Portal Spoofing VulnerabilityEPSS 0.3%CVE-2024-32530MEDIUMWordPress Simple Testimonials Showcase plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47346HIGHWordPress Newsletters plugin <= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2781MEDIUMElementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tagEPSS 0.3%CVE-2026-1048MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.3%CVE-2024-31101MEDIUMWordPress AI Twitter Feeds (Twitter widget & shortcode) plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38687MEDIUMWordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1582MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-2249MEDIUMLA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-47348HIGHWordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%