Weaknesses of type CWE-79

30,250 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6842MEDIUMFormidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-109290HIGHOpen WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX PreviewEPSS 0.3%CVE-2025-14130MEDIUMPost Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2025-3392MEDIUMhailey888 oa_system Backend MailController.java save cross site scriptingEPSS 0.3%CVE-2024-9117MEDIUMMapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-36225MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-89240MEDIUMWWBN AVideo Reflected XSS via confirmLivePassword.phpEPSS 0.3%CVE-2024-37480MEDIUMWordPress Apollo13 Framework Extensions plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23811HIGHWordPress WP2APP Plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-29196MEDIUMHTML injection via topic embedding in DiscourseEPSS 0.3%CVE-2026-93339MEDIUMDitty < 3.1.70 Stored XSS via Layout Tag Wrapper AttributeEPSS 0.3%CVE-2024-53721MEDIUMWordPress Advanced Event Manager plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44008MEDIUMWordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4176MEDIUMAn Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-InjectEPSS 0.3%CVE-2024-37512MEDIUMWordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7760HIGHReflected XSS in Ofisimo's Association Web Package FloraEPSS 0.3%CVE-2024-36239MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-1008MEDIUMRecently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view ParameterEPSS 0.3%CVE-2024-36224MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-44032MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%