Falhas do tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-7129MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.3%CVE-2026-89244MEDIUMWWBN AVideo Reflected XSS via Gallery Category getBackURLEPSS 0.3%CVE-2024-56262MEDIUMWordPress GS Coaches plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31595MEDIUMWordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-110224MEDIUMQloApps through 1.7.0 Reflected XSS via Search Alias Validation ErrorsEPSS 0.3%CVE-2025-47630MEDIUMWordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-96739MEDIUMSEMCMS KindEditor Upload upload_json.php cross site scriptingEPSS 0.3%CVE-2024-3998MEDIUMBetheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-30342MEDIUMAn XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is EPSS 0.3%CVE-2024-2784MEDIUMThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover CardEPSS 0.3%CVE-2025-22642MEDIUMWordPress Dynamic Conditions plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51769MEDIUMFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.EPSS 0.3%CVE-2024-2254MEDIUMRT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site ScriptingEPSS 0.3%CVE-2024-5263MEDIUMElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table WidgetsEPSS 0.3%CVE-2026-54720MEDIUMSilverstripe Framework: Possible XSS attack through media embedEPSS 0.3%CVE-2024-5330MEDIUMBreakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-113661MEDIUMApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsEPSS 0.3%CVE-2024-43915MEDIUMWordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56245MEDIUMWordPress Premium Blocks plugin <= 2.1.42 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31562MEDIUMWordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%