Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-24688HIGHWordPress WP Mailster Plugin <= 1.8.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24700HIGHWordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23553LOWA cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformEPSS 0.3%CVE-2025-6787MEDIUMSmart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-36371MEDIUMIn JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possibleEPSS 0.3%CVE-2025-23857HIGHWordPress Essential WP Real Estate Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-31868MEDIUMParse Server has Stored XSS via file upload of HTML-renderable file typesEPSS 0.3%CVE-2025-4774MEDIUMPremium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-22286HIGHWordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53742HIGHWordPress Multilevel Referral Affiliate plugin for WooCommerce plugin <= 2.27 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24718HIGHWordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49228MEDIUMWordPress bVerse Convert plugin <= 1.3.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50472MEDIUMWordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51683MEDIUMWordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5234MEDIUMGutenverse News <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId ParameterEPSS 0.3%CVE-2026-120218MEDIUMTypemill SvgSanitizer.php saveImage cross site scriptingEPSS 0.3%CVE-2024-49631MEDIUMWordPress Easy Addons for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51610MEDIUMWordPress Display Terms Shortcode plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51594MEDIUMWordPress Gmap Point List plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36397MEDIUMVantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%