Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23655HIGHWordPress Contact Form 7 – Paystack Add-on plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26868HIGHWordPress Fast Flow plugin <= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24630HIGHWordPress Sikshya LMS Plugin <= 0.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33984HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2025-23593HIGHWordPress EmailPress plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23657HIGHWordPress WordPress-to-candidate for Salesforce CRM plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13850MEDIUMSimple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46786MEDIUMZoom Workplace Apps - Cross-site ScriptingEPSS 0.3%CVE-2025-23651HIGHWordPress Scroll Top plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2254HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-0228MEDIUMcode-projects Local Storage Todo App index.html cross site scriptingEPSS 0.3%CVE-2025-23755HIGHWordPress PAFacile plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6432MEDIUMContent Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content ParameterEPSS 0.3%CVE-2023-23019MEDIUMCross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to funEPSS 0.3%CVE-2024-13018MEDIUMPHPGurukul Maid Hiring Management System profile.php cross site scriptingEPSS 0.3%CVE-2024-41843MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-6740MEDIUMContact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD ParameterEPSS 0.3%CVE-2024-45459HIGHWordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23750HIGHWordPress Custom Widget Creator plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23431HIGHWordPress Envato Affiliater plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%