Weaknesses of type CWE-79

29,914 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-51732MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51726MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-20249MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2023-51722MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-34691CRITICALAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-51724MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51739MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2024-33465HIGHCross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php compoEPSS 0.4%CVE-2024-8022MEDIUMGenexis Tilgin Home Gateway cross site scriptingEPSS 0.4%CVE-2026-62368HIGHSnipe-IT: Stored XSS via Custom Field name in asset-list column headersEPSS 0.4%CVE-2024-9276MEDIUMTMsoft MyAuth Gateway index.php cross site scriptingEPSS 0.4%CVE-2025-13612MEDIUMAlbum and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.4%CVE-2023-28783MEDIUMWordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-13732MEDIUMs2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-25707MEDIUMBUG-000160241 - Reflected XSS in Portal for ArcGISEPSS 0.4%CVE-2024-26300MEDIUMA vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-siEPSS 0.4%CVE-2026-17209MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-111984MEDIUMAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingEPSS 0.4%CVE-2023-20248MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2026-47099LOWTeleJSON < 6.0.0 DOM-based XSS via parse() FunctionEPSS 0.4%