Falhas do tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-13400MEDIUMSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer InformationEPSS 0.3%CVE-2026-14922MEDIUMWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo CommentEPSS 0.3%CVE-2024-34571MEDIUMWordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2025-8451MEDIUMEssential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'EPSS 0.3%CVE-2019-25445MEDIUMFiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.phpEPSS 0.3%CVE-2025-8720MEDIUMPlugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target ParameterEPSS 0.3%CVE-2024-43113MEDIUMThe contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2025-63709MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticEPSS 0.3%CVE-2025-34260MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/scheduleEPSS 0.3%CVE-2026-18084HIGHCross-Site Scripting (XSS) in Management Console of BlackBerry UEMEPSS 0.3%CVE-2026-8310MEDIUMReflected XSS in Webbeyaz's Mediküm WebEPSS 0.3%CVE-2024-38750MEDIUMWordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7090MEDIUMcode-projects Chat System send_message.php cross site scriptingEPSS 0.3%CVE-2025-0832HIGHStored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-43112MEDIUMLong pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2026-8306MEDIUMStored XSS in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2025-0469MEDIUMForminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-47643MEDIUMWordPress Include Fussball.de Widgets plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13234MEDIUMAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054EPSS 0.3%