Weaknesses of type CWE-79

30,224 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23034MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg_e' in WeGIAEPSS 0.3%CVE-2025-23594HIGHWordPress Google Map With Fancybox plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5222MEDIUMResponsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22683MEDIUMWordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23614HIGHWordPress WordPress Additional Logins plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-55199MEDIUMA Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code EPSS 0.3%CVE-2025-22244MEDIUMVMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.EPSS 0.3%CVE-2025-23598HIGHWordPress Recip.ly plugin <= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4377MEDIUMDOP Shortcodes <= 1.2 - Contributor+ Stored XSS via ShortcodeEPSS 0.3%CVE-2024-24885MEDIUMWordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-24576HIGHWordPress Landing Page Cat plugin <= 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39627MEDIUMWordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24660HIGHWordPress Simple Membership Custom Messages Plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-3149MEDIUMWP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRFEPSS 0.3%CVE-2025-9096MEDIUMExpressGateway express-gateway REST Endpoint apps.js cross site scriptingEPSS 0.3%CVE-2024-54994MEDIUMMonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the EPSS 0.3%CVE-2024-56923MEDIUMStored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6EPSS 0.3%CVE-2025-23799HIGHWordPress .TUBE Video Curator Plugin <= 1.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23030MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'cadastro_funcionario.php' parameter 'cpf' in WeGIAEPSS 0.3%CVE-2025-3749MEDIUMBreeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size ParameterEPSS 0.3%