Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-67947HIGHWordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3993MEDIUMitsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingEPSS 0.3%CVE-2025-68012HIGHWordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31091MEDIUMWordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-33533MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has bEPSS 0.3%CVE-2024-52354MEDIUMWordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6257MEDIUMEuro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency ShortcodeEPSS 0.3%CVE-2025-25078MEDIUMWordPress Google Earth Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5923MEDIUMGame Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-52358MEDIUMWordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-36956MEDIUMOpenfire 4.6.0 - 'path' Stored XSSEPSS 0.3%CVE-2025-15372MEDIUMyoulaitech vue3-element-admin Notice index.vue cross site scriptingEPSS 0.3%CVE-2025-46459MEDIUMWordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-25098MEDIUMWordPress Links in Captions plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31622MEDIUMWordPress Advanced Typekit plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25097MEDIUMWordPress External "Video for Everybody" plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49046HIGHWordPress xPromoter plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25094MEDIUMWordPress Breaking News Ticker plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-29686MEDIUMA cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a cEPSS 0.3%CVE-2025-26878MEDIUMWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%