Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8457MEDIUMPLANET Technology switch devices - Stored cross-site scripting (XSS) in the User ManagementEPSS 0.3%CVE-2023-52197MEDIUMWordPress Ads Invalid Click Protection Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-56858MEDIUMFix Javascript regexp context tracking in html/templateEPSS 0.3%CVE-2023-51372MEDIUMWordPress HashBar – WordPress Notification Bar Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-51480MEDIUMWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-47391MEDIUMWordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5973MEDIUMPHPGurukul Restaurant Table Booking System add-table.php cross site scriptingEPSS 0.3%CVE-2024-56285MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-6595NONEImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaEPSS 0.3%CVE-2025-4963MEDIUMWP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-6594NONEXSS in Special:ApiSandboxEPSS 0.3%CVE-2023-51485MEDIUMWordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-22297MEDIUMWordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-42197HIGHRELATE Vulnerable to Stored XSS via Unprivileged User ProfileEPSS 0.3%CVE-2023-52191MEDIUMWordPress Infogram Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-13639HIGHInappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write viaEPSS 0.3%CVE-2026-50765MEDIUMA stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 thrEPSS 0.3%CVE-2025-41070MEDIUMReflected Cross-site Scripting (XSS) in Sanoma's ClickeduEPSS 0.3%CVE-2024-24928MEDIUMWordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-0193MEDIUMStored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 SeriesEPSS 0.3%