Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8562MEDIUMSourceCodester PHP CRUD Add.php cross site scriptingEPSS 0.3%CVE-2025-23525HIGHWordPress Kv Compose Email From Dashboard plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33985HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2024-2861MEDIUMProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel WidgetEPSS 0.3%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2025-23786HIGHWordPress Email to Download Plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-52068MEDIUMkodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.EPSS 0.3%CVE-2026-111574HIGHRedirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug MetaboxEPSS 0.3%CVE-2025-23646HIGHWordPress Library Instruction Recorder plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47094MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2026-3951MEDIUMLockerProject Locker Error Response registry.js authIsAwesome cross site scriptingEPSS 0.3%CVE-2024-40700MEDIUMIBM Security Verify Access cross-site scriptingEPSS 0.3%CVE-2024-33986HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2025-23748HIGHWordPress Singsys -Awesome Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-25364MEDIUMOpswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.EPSS 0.3%CVE-2024-43276HIGHWordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-103888MEDIUMWPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' ParameterEPSS 0.3%CVE-2024-37245HIGHWordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23920HIGHWordPress ApplicantPro Plugin <= 1.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44053HIGHWordPress Opor Ayam theme <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%