Falhas do tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-12499MEDIUMWP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2025-8451MEDIUMEssential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'EPSS 0.3%CVE-2026-13234MEDIUMAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054EPSS 0.3%CVE-2026-10082MEDIUMAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' ParameterEPSS 0.3%CVE-2024-33992HIGHCross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemEPSS 0.3%CVE-2024-51614MEDIUMWordPress Aajoda Testimonials plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-15678MEDIUMNexter Blocks < 5.0.2 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2025-0596HIGHStored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-13231MEDIUMAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051EPSS 0.3%CVE-2026-12869MEDIUMHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template ImportEPSS 0.3%CVE-2026-65882MEDIUMJoomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1EPSS 0.3%CVE-2026-19727MEDIUMHTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation SystemEPSS 0.3%CVE-2024-43305MEDIUMWordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9939MEDIUMCodeAstro Real Estate Management System propertyview.php cross site scriptingEPSS 0.3%CVE-2024-54675MEDIUMapp/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.EPSS 0.3%CVE-2026-81918MEDIUMConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockEPSS 0.3%CVE-2026-16638MEDIUMMedia Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080EPSS 0.3%CVE-2024-43113MEDIUMThe contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2024-38750MEDIUMWordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%