Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-25593MEDIUMWordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52583MEDIUMReflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.EPSS 0.3%CVE-2026-113487MEDIUMGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeEPSS 0.3%CVE-2025-30794HIGHWordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-53688MEDIUMNagios XI < 5.11.3 XSS & CSRF via Hypermap ReplayEPSS 0.3%CVE-2024-4224MEDIUMTP-Link TL-SG1016DE XSSEPSS 0.3%CVE-2026-110524MEDIUMCopy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode AttributeEPSS 0.3%CVE-2024-53796MEDIUMWordPress Themesflat Addons For Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24712MEDIUMWordPress Heateor Social Login Plugin <= 1.1.30 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-32508MEDIUMWordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-21621MEDIUMGeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML formatEPSS 0.3%CVE-2024-22302MEDIUMWordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10685MEDIUMContact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-30848HIGHWordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-25594MEDIUMWordPress MyWaze Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-30827HIGHWordPress WP2LEADS plugin <= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2124MEDIUMControl iD RH iD API change_password cross site scriptingEPSS 0.3%CVE-2024-10048MEDIUMPost Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via pageEPSS 0.3%CVE-2024-27963MEDIUMWordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-45375CRITICALSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionEPSS 0.3%