Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-110077MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-45627HIGHArcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeoverEPSS 0.2%CVE-2026-106632MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-13610MEDIUMRegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' ShortcodeEPSS 0.2%CVE-2026-32250MEDIUMNamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/EPSS 0.2%CVE-2026-110080MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-49132MEDIUMOPNsense < 26.1.9 Stored XSS via Certificate Description FieldEPSS 0.2%CVE-2026-76718HIGHHPE OneView - Cross-site scripting vulnerabilityEPSS 0.2%CVE-2025-4776MEDIUMPhlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML AttributeEPSS 0.2%CVE-2025-56534MEDIUMA cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary EPSS 0.2%CVE-2025-56536MEDIUMA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injeEPSS 0.2%CVE-2026-107682MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-110076MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-53579HIGHWordPress Captcha.eu Plugin < 1.0.61 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-107272LOWGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesEPSS 0.2%CVE-2025-57389MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exeEPSS 0.2%CVE-2026-109307LOWCraft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationEPSS 0.2%CVE-2026-21430HIGHEmlog: CSRF chained with stored XSS leads to ATOEPSS 0.2%CVE-2026-97286MEDIUMWordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110078MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%