Falhas do tipo CWE-79

30.302 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-21572MEDIUMOpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handliEPSS 0.3%CVE-2026-0916MEDIUMRelated Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' ShortcodeEPSS 0.3%CVE-2025-69343MEDIUMWordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69321HIGHWordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50969MEDIUMuBidAuction 2.0.1 mailingLog manage Reflected XSSEPSS 0.3%CVE-2025-31500HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.EPSS 0.3%CVE-2022-50967MEDIUMuBidAuction 2.0.1 tickets manage Reflected XSSEPSS 0.3%CVE-2025-69102HIGHWordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53579CRITICALTrilium: Note Import to RCE via Book NoteEPSS 0.3%CVE-2024-1161MEDIUMBrizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesEPSS 0.3%CVE-2025-59838LOWMonkeytype Vulnerable to Self-XSS on loading saved custom textEPSS 0.3%CVE-2025-14114MEDIUM1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-60916MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas beforEPSS 0.3%CVE-2026-1889MEDIUMOutgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' AttributeEPSS 0.3%CVE-2025-22725HIGHWordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50964MEDIUMuBidAuction 2.0.1 myAuctions loose Reflected XSSEPSS 0.3%CVE-2022-50962MEDIUMuBidAuction 2.0.1 myOrders Reflected XSSEPSS 0.3%CVE-2026-65545HIGHWordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1454HIGHResponsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%