Weaknesses of type CWE-79

30,224 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-47526MEDIUMWordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-24676HIGHWordPress Custom WP Store Locator plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-38723MEDIUMMaximo Asset Management cross-site scriptingEPSS 0.3%CVE-2024-22295MEDIUMWordPress Robo Gallery Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-3866MEDIUMAdd Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23671HIGHWordPress WP OpenSearch plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54919MEDIUMA Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allEPSS 0.3%CVE-2024-6935MEDIUMformtools.org Form Tools User Settings Page cross site scriptingEPSS 0.3%CVE-2025-23596HIGHWordPress Notifikácie.sk plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24646HIGHWordPress XML for Avito Plugin <= 2.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24656HIGHWordPress Realtyna Provisioning Plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23591HIGHWordPress blu Logistics plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11582HIGHSubscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP ParameterEPSS 0.3%CVE-2026-78557HIGHA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize orEPSS 0.3%CVE-2026-3070MEDIUMSourceCodester Modern Image Gallery App upload.php cross site scriptingEPSS 0.3%CVE-2025-0578MEDIUMFacile Sistemas Cloud Apps Password Reset forgotpassword cross site scriptingEPSS 0.3%CVE-2025-24684HIGHWordPress Media Downloader Plugin <= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3412MEDIUMitsourcecode University Management System att_single_view.php cross site scriptingEPSS 0.3%CVE-2025-23590HIGHWordPress Dezdy plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23034MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg_e' in WeGIAEPSS 0.3%