Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-33386LOWXSS in QuickCMSEPSS 0.2%CVE-2026-110075MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2024-27123MEDIUMQcalAgentEPSS 0.2%CVE-2025-56537MEDIUMA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripEPSS 0.2%CVE-2026-110074MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-27683MEDIUMReflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.2%CVE-2026-108852LOWDeep Chat through 2.5.1 XSS via Markdown Link Validation BypassEPSS 0.2%CVE-2025-36126MEDIUMIBM Cognos Analytics is affected by Cross-site scripting.EPSS 0.2%CVE-2026-4791MEDIUMPeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' AttributeEPSS 0.2%CVE-2025-56535MEDIUMA cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting aEPSS 0.2%CVE-2026-101270LOWHTML injectionEPSS 0.2%CVE-2025-64198HIGHWordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111737LOWSpeed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL ListsEPSS 0.2%CVE-2026-106628MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-62074HIGHWordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110079MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-8444MEDIUMAnimation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%CVE-2026-96379LOWCookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181EPSS 0.2%CVE-2026-4919MEDIUMIBM Guardium Data Protection is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-106632MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%