Weaknesses of type CWE-79

29,598 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-26061MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-26125MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-27090MEDIUMCross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title paEPSS 0.4%CVE-2023-49492MEDIUMDedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.EPSS 0.4%CVE-2024-26028MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-26065MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-49493MEDIUMDedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.EPSS 0.4%CVE-2024-26120MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-26104MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-0800MEDIUMSourceCodester Online Courseware Edit Teacher saveeditt.php cross site scriptingEPSS 0.4%CVE-2026-76002MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2024-26103MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2026-34089LOWMemory leak in Scribunto causes runJobs.php to run out of memoryEPSS 0.4%CVE-2026-4069MEDIUMAlfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' ParameterEPSS 0.4%CVE-2024-26043MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-26080MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-26107MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-31028HIGHWordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-26124MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2022-46369MEDIUMRumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vectorEPSS 0.4%