Weaknesses of type CWE-79

30,189 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-0398MEDIUMlongpi1 warehouse Backend updateInport cross site scriptingEPSS 0.3%CVE-2024-51872MEDIUMWordPress Luzuk Testimonials plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73731MEDIUMUnauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 0.3%CVE-2023-51674MEDIUMWordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-46943MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46953MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-22361HIGHWordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23623HIGHWordPress Contact Form 7 – CCAvenue Add-on plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51906MEDIUMWordPress RSV 360 View plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-22843HIGHStored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2EPSS 0.3%CVE-2025-47072MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-51865MEDIUMWordPress Simple Social Share Block plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12495MEDIUMBootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-34381MEDIUMWordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46910MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2023-52194MEDIUMWordPress oEmbed Gist Plugin <= 4.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-22314HIGHWordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51403MEDIUMWordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-51877MEDIUMWordPress SV Forms plugin <= 2.0.05 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46899MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%