Weaknesses of type CWE-79

29,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-6006MEDIUMZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scriptingEPSS 0.4%CVE-2026-31880HIGHCombodo iTop: Reflected XSS in universal searchEPSS 0.4%CVE-2023-47696HIGHWordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6525MEDIUMElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-74800CRITICALSiYuan before v3.7.4 Stored XSS via assets endpointEPSS 0.4%CVE-2025-62366LOWMailgen vulnerable to HTML injection and cross-site scripting via plaintext email generationEPSS 0.4%CVE-2026-13360HIGHCookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' ParameterEPSS 0.4%CVE-2022-43697MEDIUMOX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.EPSS 0.4%CVE-2026-31803HIGHCombodo iTop: Reflected XSS in tag adminEPSS 0.4%CVE-2026-5324HIGHBrizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field ValueEPSS 0.4%CVE-2024-48461MEDIUMCross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the NewEPSS 0.4%CVE-2024-6368MEDIUMLabVantage LIMS POST Request cross site scriptingEPSS 0.4%CVE-2026-30890HIGHCombodo iTop: Reflected XSS in synchro/synchro_import.phpEPSS 0.4%CVE-2024-6954MEDIUMSourceCodester Record Management System sort1.php cross site scriptingEPSS 0.4%CVE-2024-26104MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2024-26125MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-26061MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-27090MEDIUMCross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title paEPSS 0.4%CVE-2026-40470CRITICALHackage package and doc upload stored XSS vulnerabilityEPSS 0.4%CVE-2024-26062MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%