Weaknesses of type CWE-79

28,952 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-48455MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.6%CVE-2023-48454MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-48561MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-48587MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-48467MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-48584MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-48557MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-48451MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-48450MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-2082MEDIUMBuy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-4423MEDIUMWP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-30768MEDIUMA Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username fieldEPSS 0.6%CVE-2022-38902MEDIUMA Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SPEPSS 0.6%CVE-2022-48085MEDIUMSoftr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.EPSS 0.6%CVE-2026-91921MEDIUMCross-Site Scripting (XSS) in 1millionbot’s AI chatbot platformEPSS 0.6%CVE-2023-2404MEDIUMCRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-6704MEDIUMComments – wpDiscuz <= 7.6.21 - Unauthenticated HTML InjectionEPSS 0.6%CVE-2023-24724MEDIUMA stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficEPSS 0.6%CVE-2021-21260HIGHXSS in description fieldEPSS 0.6%CVE-2022-31744MEDIUMAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's ContenEPSS 0.6%