Weaknesses of type CWE-79

29,816 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-43376HIGH A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause codeEPSS 0.4%CVE-2024-4234MEDIUMWordPress Filterable Portfolio plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6092MEDIUMcomfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scriptingEPSS 0.4%CVE-2023-46072HIGHWordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-51462MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2026-59672MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.4%CVE-2024-12290MEDIUMInfility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type ParameterEPSS 0.4%CVE-2022-45087MEDIUMCross-site Scripting in Smartpower WebEPSS 0.4%CVE-2024-11369MEDIUMStore credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-2979MEDIUMWCMS Registration setregister cross site scriptingEPSS 0.4%CVE-2022-48344MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.EPSS 0.4%CVE-2026-38466MEDIUMA Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864EPSS 0.4%CVE-2024-54138MEDIUMXSS Vulnerability in NuGetGallery's Markdown Autolinks ProcessingEPSS 0.4%CVE-2024-46980MEDIUMTuleap vulnerable to XSS in the HTML mail content of the cross reference fieldEPSS 0.4%CVE-2025-0710MEDIUMCampCodes School Management Software Notice Board Page notice-list cross site scriptingEPSS 0.4%CVE-2025-34281MEDIUMStored Cross-Site Scripting (XSS) in ThingsBoardEPSS 0.4%CVE-2026-33172HIGHStatamic has Stored XSS via SVG Sanitization BypassEPSS 0.4%CVE-2025-27921MEDIUMA reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injeEPSS 0.4%CVE-2025-11687MEDIUMGi-docgen: reflected dom xss in gi-docgenEPSS 0.4%CVE-2023-5114MEDIUMidbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%