Weaknesses of type CWE-79

29,914 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2023-23786MEDIUMWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-18062MEDIUMKadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image ContentEPSS 0.4%CVE-2024-12060MEDIUMWP Media Optimizer (.webp) <= 1.4.0 - Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources ParametersEPSS 0.4%CVE-2023-4371LOWphpRecDB index.php cross site scriptingEPSS 0.4%CVE-2025-46908MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-3832LOWBug Finder Wedding Wonders Ticket create cross site scriptingEPSS 0.4%CVE-2023-3541LOWThinuTech ThinuCMS author_posts.php cross site scriptingEPSS 0.4%CVE-2024-45609MEDIUMGLPI has a Reflected XSS in /front/stat.graph.phpEPSS 0.4%CVE-2023-3542LOWThinuTech ThinuCMS contact.php cross site scriptingEPSS 0.4%CVE-2025-30838MEDIUMWordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5647MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript LibraryEPSS 0.4%CVE-2025-46946MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-3835LOWBug Finder MineStack Ticket create cross site scriptingEPSS 0.4%CVE-2026-7438MEDIUMBold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%CVE-2024-31448HIGHCross-site Scripting vulnerability in link CSV import in Combodo iTopEPSS 0.4%CVE-2023-2960MEDIUMXSS in Oliva ExpertiseEPSS 0.4%CVE-2025-46880MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-33591MEDIUMUser Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the compoEPSS 0.4%CVE-2023-3830LOWBug Finder SASS BILLER store cross site scriptingEPSS 0.4%