Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-47625MEDIUMWordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12801MEDIUMUltra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesEPSS 0.3%CVE-2024-11339MEDIUMSmart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37265MEDIUMWordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28154HIGHWordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54212MEDIUMWordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12279MEDIUMcode-projects Client Details System welcome.php cross site scriptingEPSS 0.3%CVE-2026-21618HIGHCross-site scripting (XSS) in OAuth Device Authorization screenEPSS 0.3%CVE-2026-35539MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in prEPSS 0.3%CVE-2024-11903MEDIUMWP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-30557MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2026-30560MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-48875MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2024-35351MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the fiEPSS 0.3%CVE-2026-2573MEDIUMGutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'EPSS 0.3%CVE-2026-85575MEDIUMThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' ParameterEPSS 0.3%CVE-2023-50964MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.3%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.3%CVE-2024-58289MEDIUMMicroweber 2.0.15 Stored Cross-Site Scripting via User Profile FieldsEPSS 0.3%CVE-2024-35701MEDIUMWordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%