Weaknesses of type CWE-79

30,271 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-84260HIGHclick5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notificationsEPSS 0.3%CVE-2024-43952MEDIUMWordPress Esotera theme <= 1.2.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5252MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-84261HIGHclick5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notificationsEPSS 0.3%CVE-2024-5251MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-44793MEDIUMA cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to eEPSS 0.3%CVE-2023-5691MEDIUMThe Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufEPSS 0.3%CVE-2025-47088MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-30315MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-11068MEDIUMwestboy CicadasCMS save cross site scriptingEPSS 0.3%CVE-2024-5255MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-12452MEDIUMZiggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-13140LOWStored Cross-Site Scripting in Canarytokens.orgEPSS 0.3%CVE-2024-13399MEDIUMGosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41347MEDIUMopenflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.phpEPSS 0.3%CVE-2025-11485MEDIUMSourceCodester Student Grades Management System Manage Users admin.php add_user cross site scriptingEPSS 0.3%CVE-2026-100376MEDIUMTemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefixEPSS 0.3%CVE-2026-100673HIGHGrav Data Manager before 1.4.5 Stored XSS via item-detail viewEPSS 0.3%CVE-2025-47117MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-47085MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%