Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-5340MEDIUMMusic Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url ParameterEPSS 0.3%CVE-2025-0805MEDIUMMortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37856MEDIUMCross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, lEPSS 0.3%CVE-2026-26188MEDIUMSolspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations)EPSS 0.3%CVE-2024-0657MEDIUMInternal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-33080HIGHFilament: Unvalidated Range and Values summarizer values can be used for XSSEPSS 0.3%CVE-2024-0703MEDIUMSticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43127HIGHWordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-103418HIGHUniversal XSS via the HTML language attribute in Translation ServicesEPSS 0.3%CVE-2024-6849MEDIUMPreloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-46239MEDIUMMultiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-pEPSS 0.3%CVE-2024-13648MEDIUMMaps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4205MEDIUMPopup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID ParameterEPSS 0.3%CVE-2026-10632HIGHZimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterEPSS 0.3%CVE-2024-11095MEDIUMVisualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-3919MEDIUMWordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-9134MEDIUMPhoto Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode ParameterEPSS 0.3%CVE-2024-13672MEDIUMMini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-0664MEDIUMMeks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-34752HIGHWordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%