Weaknesses of type CWE-79

28,761 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-11828MEDIUMCross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitraryEPSS 0.7%CVE-2024-4484MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2025-13761HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.7%CVE-2020-16242—GE Reason S20 Ethernet SwitchEPSS 0.7%CVE-2023-30860HIGHWWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's accountEPSS 0.7%CVE-2023-26211MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an EPSS 0.7%CVE-2024-24815MEDIUMCKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detectionEPSS 0.7%CVE-2022-43420MEDIUMJenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generatEPSS 0.7%CVE-2025-34278MEDIUMNagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSSEPSS 0.7%CVE-2024-47140HIGHA cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528. A specially crafted HTTP request cEPSS 0.7%CVE-2020-5336MEDIUMRSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploitEPSS 0.7%CVE-2022-0251HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.7%CVE-2021-1490MEDIUMCisco Web Security Appliance Cross-Site Scripting VulnerabilityEPSS 0.7%CVE-2021-24813—Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2025-24415HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24412HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24416HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24417HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24413HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24414HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%