Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56998MEDIUMPHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address.EPSS 0.2%CVE-2026-28683HIGHGokapi: Stored XSS in SVG HotlinksEPSS 0.2%CVE-2026-1397MEDIUMPQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget AttributesEPSS 0.2%CVE-2026-42366HIGHGeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilitiesEPSS 0.2%CVE-2026-48301MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-47956MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-2501MEDIUMEd's Social Share <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-4086MEDIUMWP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode AttributeEPSS 0.2%CVE-2025-12631MEDIUMSquirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11496MEDIUMFive Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12125MEDIUMHTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-3427MEDIUMYoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block AttributeEPSS 0.2%CVE-2026-48304MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-47951MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-67544MEDIUMWordPress Shopkeeper Extender plugin < 7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62941MEDIUMWordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2022-50958MEDIUMWordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.phpEPSS 0.2%CVE-2025-62907MEDIUMWordPress Custom Post Type Attachment plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62912MEDIUMWordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114185MEDIUMWordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%