Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-27237MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-11770MEDIUMBrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-10228MEDIUMraisulislamg4 student_management_system_by_php admission_form_check.php cross site scriptingEPSS 0.2%CVE-2026-93681MEDIUMTutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterEPSS 0.2%CVE-2026-27249MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-116627HIGHImproper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell EPSS 0.2%CVE-2026-2737HIGHPossibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web applicationEPSS 0.2%CVE-2026-27241MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-10246MEDIUMSourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scriptingEPSS 0.2%CVE-2024-30476MEDIUMPowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious aEPSS 0.2%CVE-2025-54024MEDIUMWordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-12804MEDIUMBooking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar ShortcodeEPSS 0.2%CVE-2025-12691MEDIUMPhotonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption AttributeEPSS 0.2%CVE-2026-27232MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-9289MEDIUMCross-Site Scripting (XSS) on Omada ControllersEPSS 0.2%CVE-2025-13135MEDIUMHotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-34416MEDIUMOSCAL-GUI Reflected XSS via project parameter in oscal.phpEPSS 0.2%CVE-2026-45348HIGHpyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalEPSS 0.2%CVE-2026-27251MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-25362MEDIUMWordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%