Weaknesses of type CWE-79

29,654 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-5987MEDIUM A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability EPSS 0.4%CVE-2024-23171MEDIUMAn issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before EPSS 0.4%CVE-2025-32185MEDIUMWordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-24811HIGHCross site scripting (XSS) vulnerability using url preview in MisskeyEPSS 0.4%CVE-2024-54936MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerEPSS 0.4%CVE-2020-24857MEDIUMCross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute arbitrary code via the looking glass component.EPSS 0.4%CVE-2024-52993MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-52859MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-12842MEDIUMEmlog Pro user.php cross site scriptingEPSS 0.4%CVE-2024-52865MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-11438MEDIUMStreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-31144MEDIUMCraft CMS vulnerable to cross site scripting in RSS feed widgetEPSS 0.4%CVE-2024-11684MEDIUMKudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-52992MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2022-46843HIGHWordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28994HIGHWordPress Flatsome Theme <= 3.16.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-52991MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-53960MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-7182MEDIUMitsourcecode Student Transcript Processing System edit.php cross site scriptingEPSS 0.4%CVE-2026-27257MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%