Weaknesses of type CWE-79

28,631 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-43754MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2022-36037MEDIUMCross-site scripting (XSS) from dynamic options in the multiselect field in KirbyEPSS 0.9%CVE-2024-52822MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-52839MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-43732MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2021-41175HIGHStored XSS in Client Groups Management (Authenticated)EPSS 0.9%CVE-2022-33322MEDIUMCross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEEPSS 0.9%CVE-2022-0233MEDIUMProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2025-64130CRITICALZenitel TCIV-3+ Cross-site ScriptingEPSS 0.9%CVE-2022-0873—Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-3780HIGHCross-site Scripting (XSS) - Stored in chocobozzz/peertubeEPSS 0.9%CVE-2026-54644MEDIUMCubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message SystemEPSS 0.9%CVE-2018-3821—Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that coEPSS 0.9%CVE-2025-28121MEDIUMcode-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing reEPSS 0.9%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2019-15278MEDIUMCisco Finesse Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2022-30118—Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet ExploEPSS 0.9%CVE-2022-30119—XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitatEPSS 0.9%CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2022-2932CRITICALCross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kitEPSS 0.9%