Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-118197MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS —CVE-2026-125341LOWWinter CMS: Stored XSS through Backend List widget image columnsEPSS —CVE-2026-126075MEDIUMActive Support: Possible XSS vulnerability in Active Support MessagePack serializerEPSS —CVE-2026-67177MEDIUMChargemap stored XSSEPSS —CVE-2026-12574HIGHServer-Side HTML InjectionEPSS —CVE-2026-119097MEDIUMAuthor Image <= 4.9.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterEPSS —CVE-2026-80095CRITICALMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS —CVE-2026-121664HIGHVisual Studio Code Remote Code Execution VulnerabilityEPSS —CVE-2025-59848MEDIUMHCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's sessionEPSS —CVE-2026-121773MEDIUMWordPress GenerateBlocks plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS —CVE-2026-125761MEDIUMWordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerabilityEPSS —CVE-2026-118478MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS —CVE-2025-15711LOWLive Composer < 2.1.24 - Admin+ Stored XSS via SocialEPSS —CVE-2026-117521MEDIUMDynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author WidgetEPSS —CVE-2026-109504HIGHMicrosoft Office SharePoint Spoofing VulnerabilityEPSS —CVE-2025-59847MEDIUMHCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's sessionEPSS —CVE-2026-111300HIGHMicrosoft Office SharePoint Spoofing VulnerabilityEPSS —CVE-2026-126079MEDIUMAction View: Possible XSS vulnerability in Action View text helpersEPSS —CVE-2026-63010HIGHGroup-Office: Stored XSS via Manual RemindersEPSS —CVE-2026-117522MEDIUMDynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image WidgetEPSS —