Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-11808MEDIUMShortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-112097MEDIUMSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scriptingEPSS 0.2%CVE-2025-11764MEDIUMShortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-58920HIGHWordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27265MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-27233MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-12823MEDIUMCSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-27236MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-6251MEDIUMRoyal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13054MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-105173MEDIUMcode-projects Human Resource Management Event Creation EventStore.php cross site scriptingEPSS 0.2%CVE-2026-9024HIGHStored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026xEPSS 0.2%CVE-2025-54016MEDIUMWordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54729MEDIUMWordPress Webba Booking Plugin <= 6.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-11767MEDIUMTips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43744MEDIUMA stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 202EPSS 0.2%CVE-2026-108942MEDIUMphilz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scriptingEPSS 0.2%CVE-2026-4067MEDIUMAd Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode AttributeEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-27248MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%