Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-29689MEDIUMA cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a cEPSS 0.3%CVE-2025-5336MEDIUMClick to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number ParameterEPSS 0.3%CVE-2024-8488MEDIUMSurvey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms <= 4.9.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-29690MEDIUMA cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a cEPSS 0.3%CVE-2025-31861MEDIUMWordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14298MEDIUMFiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search ShortcodeEPSS 0.3%CVE-2025-31850MEDIUMWordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46459MEDIUMWordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2020-37148MEDIUMP5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-21331MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-39444MEDIUMWordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3572MEDIUMiTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings FieldEPSS 0.3%CVE-2025-29688MEDIUMA cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a cEPSS 0.3%CVE-2025-46477MEDIUMWordPress WP Customize Login Page plugin <= 1.6.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-25079MEDIUMWordPress Simple Select All Text Box plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41745MEDIUMIBM CICS TX Standard cross-site scriptingEPSS 0.3%CVE-2026-1821MEDIUMMicrotango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-23747MEDIUMWordPress Awesome Timeline plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52354MEDIUMWordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14202HIGHCross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File UploadEPSS 0.3%