Falhas do tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-35284MEDIUMA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to EPSS 0.3%CVE-2025-8073MEDIUMDynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name ParameterEPSS 0.3%CVE-2024-38785MEDIUMWordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-97735HIGHITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive overEPSS 0.3%CVE-2025-8208MEDIUMSpexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-8580MEDIUMInappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a cEPSS 0.3%CVE-2026-97339HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker FilterEPSS 0.3%CVE-2024-34566MEDIUMWordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35715MEDIUMWordPress Bloglo and Blogvi themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14221MEDIUMSourceCodester Online Banking System page cross site scriptingEPSS 0.3%CVE-2023-49573HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2026-2201MEDIUMZeroWdd studentmanager LeaveController.java addLeave cross site scriptingEPSS 0.3%CVE-2026-2432MEDIUMCM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin LabelsEPSS 0.3%CVE-2025-52662MEDIUMA vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under EPSS 0.3%CVE-2024-51677MEDIUMWordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9565MEDIUMBlocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe ShortcodeEPSS 0.3%CVE-2024-51578MEDIUMWordPress 3D Presentation plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52422MEDIUMWordPress WP Githuber MD plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-66470MEDIUMNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentEPSS 0.3%CVE-2024-41587MEDIUMStored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.EPSS 0.3%