Falhas do tipo CWE-79

30.306 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-61914HIGHn8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe SandboxEPSS 0.2%CVE-2026-15283MEDIUMWPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22788MEDIUMWordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54699MEDIUMWordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-49241HIGHAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionEPSS 0.2%CVE-2025-48206MEDIUMThe ns_backup extension through 13.0.0 for TYPO3 allows XSS.EPSS 0.2%CVE-2025-11262HIGHLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-12037MEDIUMFrontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-37535HIGHHCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-7775MEDIUMCross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayEPSS 0.2%CVE-2026-3343MEDIUMWatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UIEPSS 0.2%CVE-2025-53631MEDIUMflaskBlog XSS Vulnerability in postContentEPSS 0.2%CVE-2026-39070MEDIUMWordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker wEPSS 0.2%CVE-2025-31900HIGHWordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31901HIGHWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15692LOWIcegram Express < 5.8.6 - Admin+ Stored XSSEPSS 0.2%CVE-2024-28973MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. EPSS 0.2%CVE-2024-51624HIGHWordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31902HIGHWordPress Social Share And Social Locker Plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%