Falhas do tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-37951MEDIUMWordPress Magical Posts Display plugin <= 1.2.38 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-91206MEDIUMApache Roller: Reflected XSS in the optional LDAP comment authenticatorEPSS 0.3%CVE-2025-0829HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-54213MEDIUMWordPress WordPress Page Builder – Zion Builder plugin <= 3.6.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38698MEDIUMWordPress SKT Skill Bar plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-11881MEDIUMFluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time FieldEPSS 0.3%CVE-2026-59281MEDIUMSpring Framework Cross-site Scripting via EscapedErrorsEPSS 0.3%CVE-2026-13340MEDIUMSVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization BypassEPSS 0.3%CVE-2025-64030MEDIUMEximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/seEPSS 0.3%CVE-2025-0830HIGHStored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-88745MEDIUMEMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.EPSS 0.3%CVE-2026-76318MEDIUMStored Cross-Site Scripting (XSS) through Splunk Web in Splunk EnterpriseEPSS 0.3%CVE-2024-6177MEDIUMXSS vulnerability in LG SuperSign CMSEPSS 0.3%CVE-2024-56021MEDIUMWordPress Category Post Shortcode Plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5844MEDIUMRadius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName ParameterEPSS 0.3%CVE-2025-7969MEDIUMMarkdown-it 14.1.0 - Cross-site scripting (XSS)EPSS 0.3%CVE-2026-91204MEDIUMApache Roller: Stored javascript: URI in HTML commentsEPSS 0.3%CVE-2026-78742MEDIUMSilverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.EPSS 0.3%CVE-2026-11747MEDIUMReflected XSS in Seres Software's syWEBEPSS 0.3%CVE-2025-8591MEDIUMReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationEPSS 0.3%