Weaknesses of type CWE-79

28,675 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-54881MEDIUMMermaid improperly sanitizes of sequence diagram labels leading to XSSEPSS 0.8%CVE-2024-26115MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.8%CVE-2023-36800HIGHDynamics Finance and Operations Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2021-44478—A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scriEPSS 0.8%CVE-2021-24339—Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2022-20647MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20641MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20640MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20637MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20636MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2026-88060HIGHAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsEPSS 0.8%CVE-2022-20635MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-38723HIGHGravitee API Management before 3.15.13 allows path traversal through HTML injection.EPSS 0.8%CVE-2018-0719MEDIUMSecurity Advisory for Vulnerabilities in QTSEPSS 0.8%CVE-2022-20642MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2018-16459—An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.EPSS 0.8%CVE-2022-20644MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20638MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20643MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20645MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%