Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-48119MEDIUMVtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.EPSS 0.3%CVE-2025-14109MEDIUMAH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode AttributeEPSS 0.3%CVE-2025-2191MEDIUMClaro A7600-A1 Ping6 Diagnóstico form2pingv6.cgi cross site scriptingEPSS 0.3%CVE-2025-12935MEDIUMFluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' ShortcodeEPSS 0.3%CVE-2025-46878MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2023-50881MEDIUMWordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-13727MEDIUMVideo Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta ValuesEPSS 0.3%CVE-2025-12448MEDIUMSmartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4666MEDIUMZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'EPSS 0.3%CVE-2025-57968HIGHWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51914MEDIUMWordPress drop in image slideshow gallery plugin <= 12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6282MEDIUMCross-Site Scripting vulnerability in IceHrmEPSS 0.3%CVE-2025-46861MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46873MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-0318MEDIUMCross-Site Scripting in FireEye HXToolEPSS 0.3%CVE-2026-103422HIGHAnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterEPSS 0.3%CVE-2025-46857MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-1617MEDIUMNetis WF2780 Wireless 2.4G Menu cross site scriptingEPSS 0.3%CVE-2026-101924HIGHNewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query StringEPSS 0.3%CVE-2025-5879MEDIUMWuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scriptingEPSS 0.3%