Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-22329HIGHWordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36139MEDIUMIBM watsonx.data cross-site scriptingEPSS 0.2%CVE-2026-101270LOWHTML injectionEPSS 0.2%CVE-2026-110079MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-106628MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-56535MEDIUMA cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting aEPSS 0.2%CVE-2025-62076HIGHWordPress Simple Payment plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-56537MEDIUMA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripEPSS 0.2%CVE-2026-4791MEDIUMPeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' AttributeEPSS 0.2%CVE-2024-27123MEDIUMQcalAgentEPSS 0.2%CVE-2025-36126MEDIUMIBM Cognos Analytics is affected by Cross-site scripting.EPSS 0.2%CVE-2026-76719HIGHHPE OneView - Cross-site scripting vulnerabilityEPSS 0.2%CVE-2026-110074MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-62074HIGHWordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-108852LOWDeep Chat through 2.5.1 XSS via Markdown Link Validation BypassEPSS 0.2%CVE-2025-8444MEDIUMAnimation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%CVE-2025-64198HIGHWordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-33386LOWXSS in QuickCMSEPSS 0.2%CVE-2026-110075MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-111737LOWSpeed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL ListsEPSS 0.2%