Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-46410MEDIUMPublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment EPSS 0.3%CVE-2025-3782MEDIUMCision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-52268MEDIUMCross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, aEPSS 0.3%CVE-2023-52178MEDIUMWordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-35208MEDIUMlichess.org has an Unsanitized Stream Title Injection on /streamerEPSS 0.3%CVE-2024-13135MEDIUMEmlog Pro Subpage twitter.php cross site scriptingEPSS 0.3%CVE-2024-24930MEDIUMWordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-51404MEDIUMWordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25098MEDIUMWordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-24931MEDIUMWordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-52193MEDIUMWordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-40179MEDIUMPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerEPSS 0.3%CVE-2025-5972MEDIUMPHPGurukul Restaurant Table Booking System manage-subadmins.php cross site scriptingEPSS 0.3%CVE-2024-56274MEDIUMWordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4262MEDIUMPiotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget AttributesEPSS 0.3%CVE-2026-82867MEDIUM@pdfme/schemas before 5.5.9 Cross-Site Scripting via SelectEPSS 0.3%CVE-2025-26987HIGHWordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4983MEDIUMOpen VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xmlEPSS 0.3%CVE-2025-3860MEDIUMCarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass ParameterEPSS 0.3%CVE-2025-59839HIGHStar Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributesEPSS 0.3%