Weaknesses of type CWE-79

29,763 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-47942MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47970MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47981MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-11479MEDIUMAuthenticated HTML Injection in Issuetrak Ticket Comment FunctionEPSS 0.4%CVE-2024-50841MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System ProjeEPSS 0.4%CVE-2026-75736MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-5001MEDIUMHorizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-51821MEDIUMWordPress WE – Client Logo Carousel plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50514MEDIUMWordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-75737MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47980MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-71440MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-51832MEDIUMWordPress Plenigo plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-5668MEDIUMWhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-0281HIGHStored Cross-Site Scripting (XSS) in lunary-ai/lunaryEPSS 0.4%CVE-2024-51848MEDIUMWordPress Parallaxer plugin <= 1.00 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1169MEDIUMSourceCodester Image Compressor Tool compressor.php cross site scriptingEPSS 0.4%CVE-2024-54318MEDIUMWordPress NiceJob plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-48263MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47956MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%