Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-46487HIGHWordPress EC Authorize.net plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6508MEDIUMUser Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended RequestsEPSS 0.3%CVE-2024-37495MEDIUMWordPress Create by Mediavine plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8628MEDIUMPopup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37519MEDIUMWordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47870MEDIUMGetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSSEPSS 0.3%CVE-2026-22033HIGHLabel Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys fieldEPSS 0.3%CVE-2024-35698MEDIUMWordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8627MEDIUMUltimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3815MEDIUMNewspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaEPSS 0.3%CVE-2024-41345MEDIUMopenflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.phpEPSS 0.3%CVE-2026-26952MEDIUMPi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag AttributeEPSS 0.3%CVE-2025-28878MEDIUMWordPress Awesome Surveys plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3513MEDIUMUltimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attributeEPSS 0.3%CVE-2024-35732MEDIUMWordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8723MEDIUM012 PS Multi Languages <= 1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-70797MEDIUMCross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and EPSS 0.3%CVE-2024-10715MEDIUMMapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map BlockEPSS 0.3%CVE-2025-14145MEDIUMNiche Hero | Beautifully-designed blocks in seconds <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode AttributeEPSS 0.3%CVE-2025-29429MEDIUMCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, codEPSS 0.3%