Weaknesses of type CWE-79

30,248 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-26281MEDIUMUpon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin siteEPSS 0.3%CVE-2025-1703MEDIUMUltimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content ParameterEPSS 0.3%CVE-2024-2130MEDIUMCWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3570NONEStored XSS leading to Admin Account Takeover in mintplex-labs/anything-llmEPSS 0.3%CVE-2025-57764MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'EPSS 0.3%CVE-2024-36219MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-36221MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-45388MEDIUMWagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious EPSS 0.3%CVE-2024-44043MEDIUMWordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3389MEDIUMhailey888 oa_system Backend InformManageController.java testMess cross site scriptingEPSS 0.3%CVE-2026-50771MEDIUMCross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email NotEPSS 0.3%CVE-2025-5974MEDIUMPHPGurukul Restaurant Table Booking System check-status.php cross site scriptingEPSS 0.3%CVE-2024-37549MEDIUMWordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-52609MEDIUMA reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in thEPSS 0.3%CVE-2024-36227MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-38834MEDIUMStored cross-site scripting vulnerability (CVE-2024-38834)EPSS 0.3%CVE-2024-13033MEDIUMcode-projects Chat System chatroom.php cross site scriptingEPSS 0.3%CVE-2025-23882HIGHWordPress WP Download Codes Plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36229MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2021-3030MEDIUMCute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in coloEPSS 0.3%