Weaknesses of type CWE-79

28,490 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-17634—Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report frEPSS 1.9%CVE-2025-34141MEDIUMETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`EPSS 1.9%CVE-2023-29848MEDIUMBang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php EPSS 1.9%CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2019-1010091—tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code eEPSS 1.9%CVE-2020-24416HIGHBlind stored XSS in Marketo Sales insight plugin for SalesForceEPSS 1.9%CVE-2024-27314LOWStored XSS VulnerabilityEPSS 1.9%CVE-2026-48294HIGHAdobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. EPSS 1.9%CVE-2019-17632—In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conteEPSS 1.9%CVE-2021-24436—W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)EPSS 1.9%CVE-2026-41456MEDIUMBludit CMS Reflected XSS via Search PluginEPSS 1.9%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2018-16471—There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `schemEPSS 1.9%CVE-2023-0214MEDIUMXSS in Skyhigh Security SWGEPSS 1.9%CVE-2023-4973LOWAcademy LMS GET Parameter filter cross site scriptingEPSS 1.9%CVE-2020-9734CRITICALStored XSS in AEM Forms componentEPSS 1.9%CVE-2020-9741CRITICALStored XSS in AEM Forms ComponentsEPSS 1.9%CVE-2020-9740CRITICALStored XSS in AEM Design Importer ComponentEPSS 1.9%CVE-2023-29347HIGHWindows Admin Center Spoofing VulnerabilityEPSS 1.9%CVE-2022-0963MEDIUMUnrestricted XML Files Leads to Stored XSS in microweber/microweberEPSS 1.9%