Weaknesses of type CWE-79

29,765 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-48263MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-75737MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-79905MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-75731MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-75644MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-48355MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-48301MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-50514MEDIUMWordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-51810MEDIUMWordPress Lewe Bootstrap Visuals plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-4711MEDIUMWordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.4%CVE-2024-50515MEDIUMWordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-51821MEDIUMWordPress WE – Client Logo Carousel plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-47942MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-50841MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System ProjeEPSS 0.4%CVE-2026-47948MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-51804MEDIUMWordPress Moka Get Posts Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-75739MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-56412MEDIUMPhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special charactersEPSS 0.4%CVE-2024-45967MEDIUMPagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.EPSS 0.4%CVE-2023-4995MEDIUMEmbed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%