Weaknesses of type CWE-79

30,271 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-39420HIGHWordPress WP Twitter Button plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2025-61644NONEi18n XSS through Special:WatchlistEPSS 0.3%CVE-2025-11124MEDIUMcode-projects Project Monitoring System postjob.php cross site scriptingEPSS 0.3%CVE-2023-54332MEDIUMJetpack 11.4 - Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-39382HIGHWordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32646HIGHWordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13731MEDIUMAlert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box BlockEPSS 0.3%CVE-2025-2536MEDIUMCross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.EPSS 0.3%CVE-2024-11464MEDIUMEasy Code Snippets <= 1.0.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-32516HIGHWordPress Related Videos for JW Player plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32540HIGHWordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23752HIGHWordPress CGD Arrange Terms plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41785MEDIUMIBM Concert cross-site scriptingEPSS 0.3%CVE-2025-6287MEDIUMPHPGurukul COVID19 Testing Management System Take Action test-details.php cross site scriptingEPSS 0.3%CVE-2025-24548HIGHWordPress Autoglot – Automatic WordPress Translation plugin <=2.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32521HIGHWordPress Cool Flipbox plugin <= 1.8.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32578HIGHWordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32533HIGHWordPress Deliver via Shipos for WooCommerce Plugin <= 2.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32535HIGHWordPress DN Shipping by Weight for WooCommerce Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23574HIGHWordPress CubePM plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%