Weaknesses of type CWE-79

28,677 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-31059MEDIUMDiscourse Calendar Event names susceptible to Cross-site ScriptingEPSS 0.7%CVE-2025-53084CRITICALA cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8EPSS 0.7%CVE-2017-0890—Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitablEPSS 0.7%CVE-2023-3083MEDIUMCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.7%CVE-2024-34749MEDIUMPhormer prior to version 3.35 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote unauthenticated atEPSS 0.7%CVE-2022-20668MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20666MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2026-71502MEDIUMUnauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-TransmuteEPSS 0.7%CVE-2022-20667MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-26081MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2022-20674MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-41938CRITICALCross site scripting vulnerability with discussion titles in flarumEPSS 0.7%CVE-2022-20673MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20670MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20672MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-26055MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.7%CVE-2022-20669MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20671MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-3194MEDIUMMailCleaner Log File Endpoint cross site scriptingEPSS 0.7%CVE-2024-26054MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%