Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-25095MEDIUMWordPress ReverbNation Widgets plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability<EPSS 0.3%CVE-2024-12120MEDIUMRoyal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26891MEDIUMWordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42671MEDIUMA Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicioEPSS 0.3%CVE-2025-6201MEDIUMPixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-45892MEDIUMOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because iEPSS 0.3%CVE-2025-5700MEDIUMSimple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-37350MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2025-15452MEDIUMxnx3 wangmarket Backend Variable Search variableList.do variableList cross site scriptingEPSS 0.3%CVE-2025-5589MEDIUMStreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text ParameterEPSS 0.3%CVE-2024-44573MEDIUMA stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbiEPSS 0.3%CVE-2024-10000MEDIUMMasteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question FunctionalityEPSS 0.3%CVE-2025-25076MEDIUMWordPress Graceful Email Obfuscation plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4439HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2026-3982MEDIUMitsourcecode University Management System view_result.php cross site scriptingEPSS 0.3%CVE-2025-31855MEDIUMWordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67943HIGHWordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13867MEDIUMListivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-1513HIGHPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46469MEDIUMWordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%