Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-11338MEDIUMSourceCodester Ship Ferry Ticket Reservation System manage_user cross site scriptingEPSS 0.3%CVE-2026-7308MEDIUMNexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse PageEPSS 0.3%CVE-2025-6690MEDIUMWP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field ParameterEPSS 0.3%CVE-2025-24560HIGHWordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24614HIGHWordPress Post Timeline Plugin <= 2.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2424MEDIUMReward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin SettingsEPSS 0.3%CVE-2026-6504MEDIUMRoyal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' ParameterEPSS 0.3%CVE-2025-24551HIGHWordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23759HIGHWordPress Affiliate Tools Việt Nam plugin <= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24635HIGHWordPress Paytm – Donation Plugin plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-61549MEDIUMCross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions PrEPSS 0.3%CVE-2024-32762HIGHQuLog CenterEPSS 0.3%CVE-2024-44771MEDIUMBigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function.EPSS 0.3%CVE-2026-96650HIGHStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom FieldEPSS 0.3%CVE-2025-24599HIGHWordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5524MEDIUMOceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML TagEPSS 0.3%CVE-2025-24710HIGHWordPress Gwolle Guestbook plugin <= 4.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4755MEDIUMGoogle CSE <= 1.0.7 - Admin+ Stored XSSEPSS 0.3%CVE-2024-56063MEDIUMWordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-6808MEDIUMPricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' ParameterEPSS 0.3%