Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-54260MEDIUMWordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0863MEDIUMFlexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9141MEDIUMCross-Site Scripting (XSS) vulnerability in Oct8neEPSS 0.3%CVE-2026-102918MEDIUMRedux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_idEPSS 0.3%CVE-2024-9457MEDIUMWP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-54228MEDIUMWordPress Wot Elementor Widgets plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27988MEDIUMWordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33945MEDIUMWordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50942MEDIUMIncinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListenerEPSS 0.3%CVE-2025-26159MEDIUMLaravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags EPSS 0.3%CVE-2024-38675MEDIUMWordPress Arkhe Blocks plugin 2.22.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10044MEDIUMKeycloak: keycloak error_description injection on error pagesEPSS 0.3%CVE-2025-63611HIGHCross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /regisEPSS 0.3%CVE-2025-2542MEDIUMYour Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-29104MEDIUMWordPress Ticket Tailor plugin <= 1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9562MEDIUMRedirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date ShortcodeEPSS 0.3%CVE-2025-66824HIGHA Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueCoEPSS 0.3%CVE-2024-29098MEDIUMWordPress WP Calameo plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7867MEDIUMPortabilis i-Educar Agenda agenda.php cross site scriptingEPSS 0.3%CVE-2024-38686MEDIUMWordPress FancyPost plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%