Weaknesses of type CWE-79

29,655 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2399MEDIUMPremium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-27237MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-54041MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-11385MEDIUMPure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-50708MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingEPSS 0.4%CVE-2022-25629MEDIUMAn authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executeEPSS 0.4%CVE-2024-12232MEDIUMcode-projects Simple CRUD Functionality index.php cross site scriptingEPSS 0.4%CVE-2024-1348MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSEPSS 0.4%CVE-2025-22547HIGHWordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2026-41240MEDIUMDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)EPSS 0.4%CVE-2023-5892MEDIUMCross-site Scripting (XSS) - Stored in pkp/pkp-libEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2024-10086MEDIUMConsul Vulnerable To Reflected XSS On Content-Type Error ManipulationEPSS 0.4%CVE-2024-2280MEDIUMBetter Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linksEPSS 0.4%CVE-2025-22522HIGHWordPress SingSong plugin <= 1.2 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2024-12593MEDIUMPDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab ShortcodeEPSS 0.4%CVE-2026-7481HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-30953MEDIUMA stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.4%CVE-2024-2328MEDIUMReal Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%