Weaknesses of type CWE-79

29,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-5373MEDIUMKashipara College Management System submit_login.php cross site scriptingEPSS 0.4%CVE-2022-38110MEDIUMReflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-48937MEDIUMZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in ActiEPSS 0.4%CVE-2023-49151MEDIUMWordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-69690MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2024-5372MEDIUMKashipara College Management System submit_extracurricular_activity.php cross site scriptingEPSS 0.4%CVE-2014-125109LOWBestWebSoft Portfolio Plugin bws_menu.php bws_add_menu_render cross site scriptingEPSS 0.4%CVE-2024-5787MEDIUMPowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects WidgetEPSS 0.4%CVE-2024-5376MEDIUMKashipara College Management System view_each_faculty.php cross site scriptingEPSS 0.4%CVE-2023-25019HIGHWordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30511HIGHGrowatt Cloud Applications Cross-site ScriptingEPSS 0.4%CVE-2024-50659MEDIUMCross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingEPSS 0.4%CVE-2024-26101MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-22131MEDIUMCross-Site Scripting (XSS) vulnerability in generateNavigation() functionEPSS 0.4%CVE-2023-5894LOWCross-site Scripting (XSS) - Stored in pkp/ojsEPSS 0.4%CVE-2023-6844MEDIUMiframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2023-0313MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.4%CVE-2024-9528MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-31366MEDIUMAn Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,EPSS 0.4%CVE-2023-47239MEDIUMWordPress Easy PayPal Shopping Cart Plugin <= 1.1.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%