Falhas do tipo CWE-79

30.302 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-57704HIGHWordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27539HIGHWordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65511HIGHWordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-61963HIGHWordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57670HIGHWordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-51966MEDIUMA cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crEPSS 0.3%CVE-2026-28162HIGHWordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27402HIGHWordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57814HIGHWordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-84816HIGHWordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73362HIGHWordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59788MEDIUMStored XSS vulnerability in OAuth configuration formEPSS 0.3%CVE-2026-57397HIGHWordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-61965HIGHWordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-60308MEDIUMcode-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the onliEPSS 0.3%CVE-2026-56005HIGHWordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-50096MEDIUMBUG-000187164 - ArcGIS Server has a security vulnerability.EPSS 0.3%CVE-2026-66607HIGHWordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57672HIGHWordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-67612MEDIUMOpenEMR 8.2.0 Stored XSS via import_template.php Template ManagementEPSS 0.3%