Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-35714MEDIUMWordPress Idyllic theme <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-101935MEDIUMEcho Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' ParameterEPSS 0.3%CVE-2024-37221MEDIUMWordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51787MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-108260HIGH@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSEPSS 0.3%CVE-2024-36384MEDIUMPointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.EPSS 0.3%CVE-2025-3840LOWImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2025-4479MEDIUMElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2024-51584MEDIUMWordPress Marquee Elementor with Posts plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5338MEDIUMRoyal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-108935MEDIUMEdimax BR-6208AC Port Forwarding formPortFw cross site scriptingEPSS 0.3%CVE-2025-8579MEDIUMInappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user toEPSS 0.3%CVE-2024-51673MEDIUMWordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-49575HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2025-6537MEDIUMNamasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title ParameterEPSS 0.3%CVE-2024-52419MEDIUMWordPress Copy Anything to Clipboard plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10383MEDIUMContest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-112031MEDIUMChamilo LMS Ticket TicketManager.php addProject cross site scriptingEPSS 0.3%CVE-2025-30935MEDIUMWordPress Contact Form plugin <= 2.0.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-7501MEDIUMLinkStackOrg LinkStack UserController.php editPage cross site scriptingEPSS 0.3%