Falhas do tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-20553MEDIUMIBM Sterling B2B Integrator Standard Edition cross-site scriptingEPSS 0.3%CVE-2026-4175MEDIUMAureus ERP Chatter Message content-text-entry.blade.php cross site scriptingEPSS 0.3%CVE-2025-7655MEDIUMLive Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-45387MEDIUMosTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.EPSS 0.3%CVE-2024-51595MEDIUMWordPress SKSDEV Toolkit plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25958MEDIUMCross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.EPSS 0.3%CVE-2025-5291MEDIUMMaster Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide ShortcodesEPSS 0.3%CVE-2025-5703MEDIUMStageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor ParameterEPSS 0.3%CVE-2026-2064MEDIUMPortabilis i-Educar User Data meusdadod.php cross site scriptingEPSS 0.3%CVE-2026-79720MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%CVE-2024-51598MEDIUMWordPress Selar.co Widget plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67787CRITICALAn issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeovEPSS 0.3%CVE-2021-47733MEDIUMCMSimple 5.4 Cross-Site Scripting via HTML Unicode EncodingEPSS 0.3%CVE-2026-11358MEDIUMOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' ParameterEPSS 0.3%CVE-2025-8216MEDIUMSky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-79718MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%CVE-2026-5428MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption FieldEPSS 0.3%CVE-2025-7367MEDIUMStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.3%CVE-2026-121652MEDIUMStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingEPSS 0.3%CVE-2026-79719MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%