Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-96874LOWStored XSS in Cargo Drilldown tab namesEPSS 0.3%CVE-2025-32984MEDIUMNETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter.EPSS 0.3%CVE-2024-9343MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.EPSS 0.3%CVE-2025-49057HIGHWordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-28445HIGHTypebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder PreviewEPSS 0.3%CVE-2024-3648MEDIUMShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons ShortcodeEPSS 0.3%CVE-2024-9585MEDIUMImage Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2889MEDIUMLink Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional ParametersEPSS 0.3%CVE-2024-11384MEDIUMArena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28016MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login aEPSS 0.3%CVE-2025-60447MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template coEPSS 0.3%CVE-2024-10538MEDIUMHappy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image ComparisonEPSS 0.3%CVE-2025-1748MEDIUMHTML injection vulnerability in OpenCartEPSS 0.3%CVE-2025-48993MEDIUMGroup-Office vulnerable to reflected XSS via Look and Feel Formatting inputEPSS 0.3%CVE-2025-49058HIGHWordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50452MEDIUMWordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8494MEDIUMPermalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2024-35291MEDIUMCross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitraEPSS 0.3%CVE-2026-10770MEDIUMAnti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042EPSS 0.3%CVE-2024-13739MEDIUMNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To ParameterEPSS 0.3%