Weaknesses of type CWE-79

29,814 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3794MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2022-41947MEDIUMCross-site Scripting with user-uploaded files in dhis2-core EPSS 0.4%CVE-2023-36259MEDIUMCross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during usEPSS 0.4%CVE-2024-3793MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2024-3791MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2024-55659HIGHSiYuan has an arbitrary file write in the host via /api/asset/uploadEPSS 0.4%CVE-2024-25381MEDIUMThere is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.EPSS 0.4%CVE-2023-50092MEDIUMAPIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2026-85645MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-27059HIGHA cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2023-23467HIGHMedia CP Media Control Panel – Reflected XSSEPSS 0.4%CVE-2024-10510MEDIUMadBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSSEPSS 0.4%CVE-2023-47626HIGHiTop vulnerable to XSS vulnerability in authent-tokenEPSS 0.4%CVE-2025-6185HIGHLeviton AcquiSuite and Energy Monitoring Hub Cross-site ScriptingEPSS 0.4%CVE-2025-9728MEDIUMgivanz Vvveb login.tpl cross site scriptingEPSS 0.4%CVE-2024-53278MEDIUMCross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the adEPSS 0.4%CVE-2023-51461MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-45254HIGHVaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.4%CVE-2023-51460MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-5878MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryEPSS 0.4%