Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-28154HIGHWordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37217MEDIUMWordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53441MEDIUMJenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of EPSS 0.3%CVE-2024-11903MEDIUMWP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-34255MEDIUMjizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.EPSS 0.3%CVE-2026-8607MEDIUMmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode AttributeEPSS 0.3%CVE-2021-33025MEDIUMxArrow SCADA Path TraversalEPSS 0.3%CVE-2024-11904MEDIUM코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-31027MEDIUMCross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbEPSS 0.3%CVE-2024-47392MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12112MEDIUMEasy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-35699MEDIUMWordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-30558MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2024-43309MEDIUMWordPress WP Telegram Widget and Join Link plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37263MEDIUMWordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7877MEDIUMWP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' ShortcodeEPSS 0.3%CVE-2025-60454MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image manaEPSS 0.3%CVE-2026-1888MEDIUMDocus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-45456MEDIUMWordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50447MEDIUMWordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%