Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-111942MEDIUMhrisikeshpal Blood_Bank_Management_System abs.php cross site scriptingEPSS 0.3%CVE-2025-0062MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.3%CVE-2026-111110HIGHPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterEPSS 0.3%CVE-2015-20115MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload ParameterEPSS 0.3%CVE-2026-19657MEDIUMScadaLTS Unauthenticated Reflected XSSEPSS 0.3%CVE-2023-37940MEDIUMCross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.EPSS 0.3%CVE-2024-39242MEDIUMA cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.3%CVE-2020-36931MEDIUMClick2Magic 1.1.5 - Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32809MEDIUMW. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedbacEPSS 0.3%CVE-2025-14201MEDIUMalokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scriptingEPSS 0.3%CVE-2026-81812MEDIUMElementor < 4.3.5 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2025-56697MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara CoEPSS 0.3%CVE-2026-57568MEDIUMLychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)EPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2025-29018MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking SystEPSS 0.3%CVE-2026-24837HIGHDotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation ModalEPSS 0.3%CVE-2025-53528HIGHCadwyn is vulnerable to an XSS attack through its docs pageEPSS 0.3%CVE-2024-8473MEDIUMSQL injection vulnerability in Job PortalEPSS 0.3%CVE-2025-8874MEDIUMMaster Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBoxEPSS 0.3%CVE-2026-10173MEDIUMOrthanc Explorer 2 URL StudyList.vue cross site scriptingEPSS 0.3%