Falhas do tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-36372MEDIUMIn JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possibleEPSS 0.3%CVE-2026-25500MEDIUMRack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefEPSS 0.3%CVE-2026-102626HIGHLimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributeEPSS 0.3%CVE-2025-29011MEDIUMWordPress YouTube Simple Gallery plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47786LOWEmlog vulnerable to Stored Cross-site ScriptingEPSS 0.3%CVE-2025-9119MEDIUMNetis WF2419 Wireless Settings index.htm cross site scriptingEPSS 0.3%CVE-2025-31591MEDIUMWordPress Exit Popup Free plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50952MEDIUMBanco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name InputEPSS 0.3%CVE-2024-36367MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possibleEPSS 0.3%CVE-2025-25988MEDIUMCross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parametEPSS 0.3%CVE-2026-5341MEDIUMNMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-63842MEDIUMA Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user tEPSS 0.3%CVE-2024-50468MEDIUMWordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47834MEDIUMSchlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)EPSS 0.3%CVE-2024-51572MEDIUMWordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2012-20004MEDIUMK-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff ParameterEPSS 0.3%CVE-2025-49244MEDIUMWordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-49242MEDIUMWordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-116097MEDIUMCloudClassroom-PHP-Project addnewstudent.php cross site scriptingEPSS 0.3%CVE-2025-48237MEDIUMWordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%