Weaknesses of type CWE-79

29,816 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-43376HIGH A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause codeEPSS 0.4%CVE-2023-39370HIGH StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) EPSS 0.4%CVE-2025-65778HIGHAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be servedEPSS 0.4%CVE-2024-27091MEDIUMGeoNode stored XSS to full account takeoverEPSS 0.4%CVE-2023-31180MEDIUM WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS)EPSS 0.4%CVE-2023-51457MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-59974CRITICALJunos Space Security Director: Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-59672MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.4%CVE-2023-33322HIGHWordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-51463MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2023-30472HIGHWordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54998MEDIUMMonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/deEPSS 0.4%CVE-2024-4234MEDIUMWordPress Filterable Portfolio plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-46072HIGHWordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-59673MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.4%CVE-2023-51464MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-25369MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the grEPSS 0.4%CVE-2026-33135CRITICALWeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameterEPSS 0.4%CVE-2023-51462MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-6092MEDIUMcomfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scriptingEPSS 0.4%