Weaknesses of type CWE-79

29,918 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-46940MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-7623MEDIUMSureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block AttributeEPSS 0.4%CVE-2026-26211MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via System Name FieldEPSS 0.4%CVE-2025-46905MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-6178MEDIUMBetheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' ShortcodeEPSS 0.4%CVE-2023-3539LOWSimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2025-47075MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-46929MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-27666MEDIUMAuto Dealer Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the name parameter at /classes/SEPSS 0.4%CVE-2025-46965MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-3861LOWphpscriptpoint Insurance search.php cross site scriptingEPSS 0.4%CVE-2023-1946LOWSourceCodester Survey Application System Add New cross site scriptingEPSS 0.4%CVE-2025-26922MEDIUMWordPress AuraMart theme <= 2.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-46893MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-42509MEDIUMApache Wicket: crafted strings can break out of the JavaScript sequenceEPSS 0.4%CVE-2023-22985MEDIUMSourcecodester Simple Guestbook Management System version 1 is vulnerable to Cross Site Scripting (XSS) via Name, Referrer, Location, and CoEPSS 0.4%CVE-2025-46927MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-15021MEDIUMwpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile FieldEPSS 0.4%CVE-2023-3536LOWSimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2023-1051MEDIUMXSS in As Koc Web Report SystemEPSS 0.4%