Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-49266MEDIUMWordPress WP-Spreadplugin plugin <= 4.8.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3876HIGHPrismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-ShortcodeEPSS 0.3%CVE-2024-37537MEDIUMWordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4877MEDIUMitsourcecode Payroll Management System index.php cross site scriptingEPSS 0.3%CVE-2026-27222MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2022-42000LOWPotential XSS in comment sectionEPSS 0.3%CVE-2026-10301MEDIUMitsourcecode Fees Management System index.php cross site scriptingEPSS 0.3%CVE-2024-9119MEDIUMSVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-7963MEDIUMCMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-39643MEDIUMWordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-41117MEDIUMXSS in Grafana Explore stack traceEPSS 0.3%CVE-2025-64551MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-26751HIGHWordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-64569MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-42920MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship ManagementEPSS 0.3%CVE-2025-7725HIGHPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-10254MEDIUMAscensio System SIA OnlyOffice SVG Image Messages.aspx cross site scriptingEPSS 0.3%CVE-2025-23487HIGHWordPress Easy Gallery plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-58038NONEStored XSS through javascript URLs in SVGs generated by EasyTimelineEPSS 0.3%CVE-2025-20123MEDIUMCisco Crosswork Network Controller Stored Cross-Site Scripting VulnerabilityEPSS 0.3%