Weaknesses of type CWE-79

30,116 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-56809MEDIUMMultiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vEPSS 0.3%CVE-2022-36244MEDIUMMultiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesEPSS 0.3%CVE-2023-30452MEDIUMThe MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parEPSS 0.3%CVE-2024-5540MEDIUMALC WebCTRL Carrier i-Vu Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-1010HIGHStored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege EscalationEPSS 0.3%CVE-2026-5319MEDIUMitsourcecode Payroll Management System navbar.php cross site scriptingEPSS 0.3%CVE-2025-46843MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46863MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46853MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-12090HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-46870MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-4323MEDIUMMRCMS Edit Article Page cross site scriptingEPSS 0.3%CVE-2024-31108MEDIUMWordPress iFlyChat plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11338MEDIUMPIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-0320MEDIUMXSS in UBYSEPSS 0.3%CVE-2023-30436MEDIUMIBM Security Guardium cross-site scriptingEPSS 0.3%CVE-2024-12403MEDIUMImage Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-52175MEDIUMWordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-118246HIGHHighcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesEPSS 0.3%CVE-2025-3806MEDIUMdazhouda lecms Edit Profile admin cross site scriptingEPSS 0.3%