Weaknesses of type CWE-79

29,765 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-75738MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-54880MEDIUMMermaid does not properly sanitize architecture diagram iconText leading to XSSEPSS 0.4%CVE-2026-47953MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-46396CRITICALHAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeoverEPSS 0.4%CVE-2023-39918HIGHWordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-75642MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-39314HIGHWordPress Leyka Plugin <= 3.30.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50842MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0.EPSS 0.4%CVE-2026-47944MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-51854MEDIUMWordPress Hola Free Video Player plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-46496CRITICALHAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftEPSS 0.4%CVE-2026-75733MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-1157MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URLEPSS 0.4%CVE-2023-39306HIGHWordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-48297MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-75643MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-51803MEDIUMWordPress Inline Click To Tweet plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-47973MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47941MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-51847MEDIUMWordPress WP PagSeguro Payments plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%