Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-46859MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-47226MEDIUMA stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel viaEPSS 0.3%CVE-2024-2727MEDIUMStored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemEPSS 0.3%CVE-2025-3750MEDIUMNetwork Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height ParameterEPSS 0.3%CVE-2025-46860MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-60507HIGHCross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF coEPSS 0.3%CVE-2024-51889MEDIUMWordPress Fancy User List plugin <= 3.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-22674MEDIUMHashgraph Guardian Stored XSS via branding companyName fieldEPSS 0.3%CVE-2025-46851MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47828MEDIUMLumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.EPSS 0.3%CVE-2024-51868MEDIUMWordPress DuoGeek Blocks plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51910MEDIUMWordPress Assist24 Help Desk plugin <= 20150401.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7066MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauEPSS 0.3%CVE-2023-52084LOWWinter CMS Stored XSS through Backend ColorPicker FormWidgetEPSS 0.3%CVE-2024-51909MEDIUMWordPress audioCase plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2179LOWConcrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group typeEPSS 0.3%CVE-2026-0867MEDIUMEssential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-25854MEDIUMCross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the SuEPSS 0.3%CVE-2024-30425MEDIUMWordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48244MEDIUMWordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%