Falhas do tipo CWE-79

30.296 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-22771MEDIUMWordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2685MEDIUMTablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26870MEDIUMWordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4846MEDIUMdameng100 muucmf autoReply.html cross site scriptingEPSS 0.3%CVE-2025-48920HIGHetracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074EPSS 0.3%CVE-2026-58391MEDIUMOPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutEPSS 0.3%CVE-2024-1399MEDIUMRestaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-26749MEDIUMWordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34566CRITICALCI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2025-61674MEDIUMOctober CMS Vulnerable to Stored XSS via Editor and Branding StylesEPSS 0.3%CVE-2025-15055HIGHSlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' ParametersEPSS 0.3%CVE-2026-5247MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode AttributeEPSS 0.3%CVE-2024-43130MEDIUMWordPress Football Pool plugin <= 2.11.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22340MEDIUMWordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0054MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-69296HIGHWordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50412MEDIUMWordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5015MEDIUMelecV2 elecV2P Endpoint logs cross site scriptingEPSS 0.3%CVE-2024-37545MEDIUMWordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68843HIGHWordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%