Weaknesses of type CWE-79

28,694 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-50758HIGHCross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp paraEPSS 0.7%CVE-2024-30194HIGHWordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2021-43842MEDIUMStored XSS via SVG file upload in Wiki.jsEPSS 0.7%CVE-2023-49489MEDIUMReflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalaEPSS 0.7%CVE-2022-25610LOWWordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2022-0602HIGHCross-site Scripting (XSS) - DOM in tastyigniter/tastyigniterEPSS 0.7%CVE-2022-1464HIGHStored xss bug in gogs/gogsEPSS 0.7%CVE-2021-24565—Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSSEPSS 0.7%CVE-2024-54034CRITICALAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.7%CVE-2024-55228CRITICALA cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts EPSS 0.7%CVE-2024-24134MEDIUMSourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update MEPSS 0.7%CVE-2024-54036CRITICALAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2022-41225MEDIUMJenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in aEPSS 0.7%CVE-2019-3865MEDIUMA vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able EPSS 0.7%CVE-2022-31187MEDIUMStored Cross Site Scripting (XSS) through global search in GLPIEPSS 0.7%CVE-2024-36171MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-36153MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-26110MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-36170MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-36172MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%