Falhas do tipo CWE-79

30.306 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-53212HIGHWordPress Revolution Video Player With Bottom Playlist <= 2.9.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-61796MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-61636NONECodex Special:Block vulnerable to message key XSSEPSS 0.2%CVE-2026-97640HIGHWPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)EPSS 0.2%CVE-2025-48163HIGHWordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53290MEDIUMWordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-5063HIGHNEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key NamesEPSS 0.2%CVE-2026-103996MEDIUMIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' AttributeEPSS 0.2%CVE-2026-54866HIGHWordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62264MEDIUMReflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.QEPSS 0.2%CVE-2025-58177MEDIUMn8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameterEPSS 0.2%CVE-2026-5340MEDIUMFancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-109147HIGHWP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' ParameterEPSS 0.2%CVE-2025-22483HIGHLicense CenterEPSS 0.2%CVE-2026-109978MEDIUMCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block AttributeEPSS 0.2%CVE-2025-63057MEDIUMWordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22697MEDIUMWordPress Responsive Blocks plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54676MEDIUMWordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53563HIGHWordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53562HIGHWordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%