Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-30548HIGHWordPress Advanced Post Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53796MEDIUMWordPress Themesflat Addons For Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22310MEDIUMWordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25920MEDIUMWordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30544HIGHWordPress OK Poster Group plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2715MEDIUMtimschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scriptingEPSS 0.3%CVE-2024-3851MEDIUMUnrestricted File Upload Leading to XSS in imartinez/privategptEPSS 0.3%CVE-2025-30869HIGHWordPress Image Wall plugin <= 3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-119764HIGHMythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File PreviewEPSS 0.3%CVE-2026-23839CRITICALMovary vulnerable to Cross-site Scripting with `?categoryUpdated=` paramEPSS 0.3%CVE-2024-32456MEDIUMWordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9823MEDIUMReflected XSS in lead:addLeadTags - Quick AddEPSS 0.3%CVE-2026-3702MEDIUMSourceCodester Loan Management System index.php cross site scriptingEPSS 0.3%CVE-2026-3763MEDIUMcode-projects Simple Flight Ticket Booking System showhistory.php cross site scriptingEPSS 0.3%CVE-2024-38674MEDIUMWordPress SKT Addons for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22150MEDIUMWordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-9864MEDIUMEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11900MEDIUMPortfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9375MEDIUMWordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-107098MEDIUMRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingEPSS 0.3%