Weaknesses of type CWE-79

30,190 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-46915MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2023-51493MEDIUMWordPress Custom Post Carousels with Owl Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-46963MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-46918MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-51898MEDIUMWordPress Semantic Shortcode plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43809LOWIn JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset pageEPSS 0.3%CVE-2024-51902MEDIUMWordPress TinyCode plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-45448LOWCross-site Scripting in M4 PDF plugin for Prestashop sitesEPSS 0.3%CVE-2025-27109HIGHLack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-jsEPSS 0.3%CVE-2025-46914MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46931MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-51892MEDIUMWordPress Sell Media File with Stripe plugin <= 1.0.6 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51684MEDIUMWordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-51879MEDIUMWordPress Text Advertisements plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22331HIGHWordPress Cf7Save Extension plugin <= 1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51917MEDIUMWordPress Multiple Votes in one page plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29926MEDIUMWordPress WC Builder plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46913MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-4577MEDIUMSmash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` AttributeEPSS 0.3%CVE-2025-22521HIGHWordPress wp Hosting Performance Check Plugin <= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%