Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-8699HIGHStored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management InterfaceEPSS 0.3%CVE-2025-46537HIGHWordPress Section Widget plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9357MEDIUMvBulletin Login cross site scriptingEPSS 0.3%CVE-2024-9867MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map WidgetEPSS 0.3%CVE-2026-109291HIGHOpen WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_urlEPSS 0.3%CVE-2026-88055MEDIUMAnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGeneratorEPSS 0.3%CVE-2024-37488MEDIUMWordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28875MEDIUMWordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2024-9366MEDIUMEasy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-39537HIGHWordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11027MEDIUMgivanz Vvveb SVG File cross site scriptingEPSS 0.3%CVE-2026-57568MEDIUMLychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)EPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2026-21291MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-0062MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.3%CVE-2026-78902MEDIUMCross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packaEPSS 0.3%CVE-2025-5678MEDIUMKadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` ParameterEPSS 0.3%CVE-2025-56697MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara CoEPSS 0.3%CVE-2020-36932MEDIUMSeacms 11.1 - 'checkuser' Stored XSSEPSS 0.3%CVE-2015-20115MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload ParameterEPSS 0.3%