Falhas do tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-51963MEDIUMStored XSS in ArcGIS Server ManagerEPSS 0.3%CVE-2025-66939MEDIUMCross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon fiEPSS 0.3%CVE-2025-23894HIGHWordPress wp-flickr-press Plugin <= 2.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2025-22357HIGHWordPress Target Notifications plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-92225MEDIUMJoomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3EPSS 0.3%CVE-2024-51959MEDIUMStored XSS issue in Server Admin APIEPSS 0.3%CVE-2025-46475MEDIUMWordPress Able Player plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-7716MEDIUMReal-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091EPSS 0.3%CVE-2024-12020MEDIUMReflected Cross-Site Scripting (XSS)EPSS 0.3%CVE-2025-63830MEDIUMCKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing actiEPSS 0.3%CVE-2026-8624MEDIUMLJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF ParameterEPSS 0.3%CVE-2025-65790MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FEPSS 0.3%CVE-2025-23729HIGHWordPress XTRA Settings plugin <= 2.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12471MEDIUMHubbub Lite <= 1.36.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-29322MEDIUMA cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted EPSS 0.3%CVE-2024-37173MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)EPSS 0.3%CVE-2025-23540HIGHWordPress WP Front-end login and register plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23636HIGHWordPress My Favorite Car plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22733HIGHWordPress My auctions allegro Plugin <= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%