Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-70033MEDIUMAn issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.EPSS 0.3%CVE-2026-14292MEDIUMWordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package TitleEPSS 0.3%CVE-2024-53279MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in SynologyEPSS 0.3%CVE-2026-88942MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON ParameterEPSS 0.3%CVE-2026-13374MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration ConfigurationEPSS 0.3%CVE-2024-37436HIGHWordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47808MEDIUMCotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5312MEDIUMCross-Site Scripting vulnerability in PHP Server MonitorEPSS 0.3%CVE-2025-6540MEDIUMweb-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug ParameterEPSS 0.3%CVE-2025-28929MEDIUMWordPress Tabbed Login Widget plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39647HIGHWordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43246HIGHWordPress WHMpress plugin <= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3065MEDIUMPayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-48032HIGHWordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53285MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology EPSS 0.3%CVE-2026-13376MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker ModuleEPSS 0.3%CVE-2026-96566HIGHNewsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field ParameterEPSS 0.3%CVE-2024-3579MEDIUMXSS in Online Shopping System AdvancedEPSS 0.3%CVE-2025-53526LOWWeGIA allows Stored XSS attacks in novo_memorando.phpEPSS 0.3%CVE-2024-53284MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in EPSS 0.3%