Weaknesses of type CWE-79

29,882 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-0981HIGHOkta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs wheEPSS 0.4%CVE-2026-104900MEDIUMMISP Stored XSS via Unescaped Count Field Value in Remote Event Preview IndexEPSS 0.4%CVE-2024-6082MEDIUMPHPVibe Global Options Page functionalities.global.php cross site scriptingEPSS 0.4%CVE-2026-9280MEDIUMAd Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe ModeEPSS 0.4%CVE-2026-103321HIGHMISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImageEPSS 0.4%CVE-2022-45758MEDIUMSENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.EPSS 0.4%CVE-2024-30433MEDIUMWordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29775MEDIUMWordPress Frontend Dashboard plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-71388MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75667MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-48260MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-48257MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75694MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-34413MEDIUMWordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-48253MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-48415MEDIUMitsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlEPSS 0.4%CVE-2026-75670MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75685MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-30452MEDIUMWordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-19713MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%