Weaknesses of type CWE-79

30,112 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-3801MEDIUMsongquanpeng one-api System Setting cross site scriptingEPSS 0.3%CVE-2022-36244MEDIUMMultiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesEPSS 0.3%CVE-2024-5540MEDIUMALC WebCTRL Carrier i-Vu Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-46844MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-5630MEDIUMassafelovic gpt-researcher Report API app.py cross site scriptingEPSS 0.3%CVE-2023-34461MEDIUMCross-site Scripting (XSS) Availability in PyBBEPSS 0.3%CVE-2025-46838MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-56410MEDIUMPhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom propertiesEPSS 0.3%CVE-2024-10091MEDIUMElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2025-4292MEDIUMMRCMS Edit User Page edit.do cross site scriptingEPSS 0.3%CVE-2025-46848MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2023-30452MEDIUMThe MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parEPSS 0.3%CVE-2024-0656MEDIUMPassword Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-118245HIGHHighcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespaceEPSS 0.3%CVE-2026-1010HIGHStored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege EscalationEPSS 0.3%CVE-2025-46854MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-4293MEDIUMMRCMS Group Edit Page edit.do cross site scriptingEPSS 0.3%CVE-2023-3319MEDIUMXSS in iDisplays PlatPlay DSEPSS 0.3%CVE-2024-12090HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-29115MEDIUMWordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%