Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-34375HIGHAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageEPSS 0.3%CVE-2024-36656MEDIUMIn MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.EPSS 0.3%CVE-2021-47920MEDIUMWebMO Job Manager 20.0 Cross-Site Scripting via Search ParametersEPSS 0.3%CVE-2024-43217HIGHWordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37776MEDIUMA cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.3%CVE-2025-1489MEDIUMWP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox ShortcodeEPSS 0.3%CVE-2026-33348HIGHOpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3EPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%CVE-2024-43126HIGHWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20203MEDIUMA vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coEPSS 0.3%CVE-2024-5406MEDIUMMultiple vulnerabilities in WinNMP from WtripleEPSS 0.3%CVE-2024-43959HIGHWordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46333MEDIUMAn authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a EPSS 0.3%CVE-2025-0706MEDIUMJoeyBling bootplus admin.html cross site scriptingEPSS 0.3%CVE-2024-47333HIGHWordPress Loops & Logic plugin <= 4.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6497MEDIUMWordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-39534HIGHWordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52746HIGHWordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-37003MEDIUMSellacious eCommerce 4.6 - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2025-55175MEDIUMReflected XSS in QuickCMSEPSS 0.3%