Weaknesses of type CWE-79

30,104 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-28380MEDIUMA cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injeEPSS 0.3%CVE-2025-64392MEDIUMThis vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craftEPSS 0.3%CVE-2024-33693MEDIUMWordPress Meks Smart Social Widget plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.3%CVE-2026-10289MEDIUMcode-projects Hotel and Tourism Reservation System tour.php cross site scriptingEPSS 0.3%CVE-2023-23856MEDIUMIn SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content typeEPSS 0.3%CVE-2024-32591MEDIUMWordPress Backend Designer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-43962MEDIUMCross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project nEPSS 0.3%CVE-2026-55877MEDIUMSymfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responsesEPSS 0.3%CVE-2026-54714MEDIUMLogto: XSS via unescaped RelayState in SAML auto-submit formEPSS 0.3%CVE-2025-46848MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-12090HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-46871MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-118244HIGHHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printEPSS 0.3%CVE-2024-5540MEDIUMALC WebCTRL Carrier i-Vu Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-12091HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-27740MEDIUMDiscourse has Stored XSS in AI Triage AutomationEPSS 0.3%CVE-2026-6034MEDIUMcode-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scriptingEPSS 0.3%CVE-2022-4901LOWMultiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciouEPSS 0.3%CVE-2024-56410MEDIUMPhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom propertiesEPSS 0.3%