Weaknesses of type CWE-79

30,283 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-37409MEDIUMWordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32608HIGHWordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32653HIGHWordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14538MEDIUMyangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scriptingEPSS 0.3%CVE-2025-5884MEDIUMKonica Minolta bizhub Display MFP Information List cross site scriptingEPSS 0.3%CVE-2025-22263HIGHWordPress Global Gallery plugin <= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5258MEDIUMConference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-11687MEDIUMNext-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27313HIGHWordPress Google Maps GPX Viewer Plugin <= 3.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24539HIGHWordPress DeBounce Email Validator plugin <= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27319HIGHWordPress User List plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10366MEDIUMMiczFlor RPi-Jukebox-RFID inc.setWlanIpMail.php cross site scriptingEPSS 0.3%CVE-2024-12813MEDIUMOpen Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-27308HIGHWordPress WP Video Posts plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39432HIGHWordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerabilityEPSS 0.3%CVE-2025-32674HIGHWordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin <= 4.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-25860MEDIUMOpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload HandlerEPSS 0.3%CVE-2025-32637HIGHWordPress WP Donate Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4310MEDIUMCross-site Scripting (XSS) vulnerability in HubBankEPSS 0.3%CVE-2025-31018HIGHWordPress FireDrum Email Marketing plugin <= 1.64 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%