Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62074HIGHWordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110080MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-56536MEDIUMA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injeEPSS 0.2%CVE-2026-110076MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-45627HIGHArcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeoverEPSS 0.2%CVE-2025-12067MEDIUMTable Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell ContentEPSS 0.2%CVE-2026-4919MEDIUMIBM Guardium Data Protection is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-49132MEDIUMOPNsense < 26.1.9 Stored XSS via Certificate Description FieldEPSS 0.2%CVE-2025-13610MEDIUMRegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' ShortcodeEPSS 0.2%CVE-2026-109307LOWCraft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationEPSS 0.2%CVE-2026-76718HIGHHPE OneView - Cross-site scripting vulnerabilityEPSS 0.2%CVE-2026-106632MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-110078MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-56534MEDIUMA cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary EPSS 0.2%CVE-2026-110077MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-97286MEDIUMWordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-96379LOWCookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181EPSS 0.2%CVE-2025-54055HIGHWordPress Druco <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54724HIGHWordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-32250MEDIUMNamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/EPSS 0.2%