Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-12130MEDIUMCodeAstro Human Resource Management System Projects Management Add_Projects cross site scriptingEPSS 0.2%CVE-2025-64858MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-64841MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-10234MEDIUMMettle sendportal Campaign webview cross site scriptingEPSS 0.2%CVE-2026-2924MEDIUMGutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'EPSS 0.2%CVE-2026-111840HIGHWordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-35453MEDIUMPhpSpreadsheet XSS via number format text substitution in HTML WriterEPSS 0.2%CVE-2025-10926MEDIUMJSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106EPSS 0.2%CVE-2025-50733MEDIUMNextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute EPSS 0.2%CVE-2026-7296MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scriptingEPSS 0.2%CVE-2026-7297MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scriptingEPSS 0.2%CVE-2025-53222HIGHWordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6396MEDIUMXSS in Webbeyaz's web siteEPSS 0.2%CVE-2025-26258MEDIUMSourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'EPSS 0.2%CVE-2026-90918MEDIUMJoomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3EPSS 0.2%CVE-2026-8221MEDIUMDevs Palace ERP Online item-save cross site scriptingEPSS 0.2%CVE-2023-32120MEDIUMWordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)EPSS 0.2%CVE-2026-1877MEDIUMAuto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_pageEPSS 0.2%CVE-2026-9377MEDIUMSourceCodester SUP Online Shopping productedit.php cross site scriptingEPSS 0.2%CVE-2026-8220MEDIUMDevs Palace ERP Online customer-save cross site scriptingEPSS 0.2%