Falhas do tipo CWE-79

30.303 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-64576MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-64572MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-49413HIGHWordPress Super Store Finder Plugin <= 7.6 - Reflected Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-3766MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scriptingEPSS 0.3%CVE-2025-64821MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-26991MEDIUMLibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups nameEPSS 0.3%CVE-2025-64620MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-64558MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-64789MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-64603MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-64583MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-13627MEDIUMMakesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' SettingEPSS 0.3%CVE-2025-64616MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-49956HIGHWordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56356MEDIUMn8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS FieldEPSS 0.3%CVE-2025-64605MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-10075MEDIUMSourceCodester Online Polling System manage-profile.php cross site scriptingEPSS 0.3%CVE-2025-12280MEDIUMcode-projects Client Details System update-clients.php cross site scriptingEPSS 0.3%CVE-2025-52750HIGHWordPress Emu2 plugin <= 0.83b - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-64557MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%