Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-95866HIGHUser Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar FieldEPSS 0.3%CVE-2025-66563HIGHMonkeytype vulnerable to stored XSS in approve quotes pageEPSS 0.3%CVE-2025-26896MEDIUMWordPress PiwigoPress plugin <= 2.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50020MEDIUMWordPress RDFa Breadcrumb plugin <= 2.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-2804MEDIUMtagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'EPSS 0.3%CVE-2021-3841MEDIUMStored Cross-site Scripting (XSS) in sylius/syliusEPSS 0.3%CVE-2024-51507MEDIUMTiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name.EPSS 0.3%CVE-2025-50014MEDIUMWordPress PDPA Consent for Thailand plugin <= 1.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-50023MEDIUMWordPress CodePen Embed Block plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-25802HIGHNew API has Potential XSS in its MarkdownRenderer componentEPSS 0.3%CVE-2026-81201MEDIUMMonster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116EPSS 0.3%CVE-2025-26887MEDIUMWordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22648MEDIUMWordPress Blog, Posts and Category Filter for Elementor plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6460MEDIUMDisplay During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message ParameterEPSS 0.3%CVE-2025-26939MEDIUMWordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26893MEDIUMWordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22660MEDIUMWordPress Include Mastodon Feed plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10332MEDIUMA Cross-Site Scripting vulnerability has been found in Janto v4.3r11 from Impronta. This vulnerability allows an attacker to execute JavaScrEPSS 0.3%CVE-2025-1773MEDIUMTraveler <= 3.1.8 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27693MEDIUMDell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site EPSS 0.3%