Falhas do tipo CWE-79

30.306 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-13416LOWCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmediaEPSS 0.2%CVE-2025-31901HIGHWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54687MEDIUMWordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-1437MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2025-22767HIGHWordPress GlobalPayments WooCommerce Plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-86491LOWIn JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploadsEPSS 0.2%CVE-2024-6361HIGHImproper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product.EPSS 0.2%CVE-2025-50367MEDIUMA stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name EPSS 0.2%CVE-2025-54699MEDIUMWordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-15695LOWGTranslate < 3.0.10 - Admin+ Stored XSSEPSS 0.2%CVE-2025-67475NONEStored XSS through edit summaries in MW CoreEPSS 0.2%CVE-2024-28973MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. EPSS 0.2%CVE-2024-13463MEDIUMSeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-31899HIGHWordPress Awesome Logos plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-12163MEDIUMStored XSS in Fortra File Integrity Monitoring (FIM)EPSS 0.2%CVE-2026-3343MEDIUMWatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UIEPSS 0.2%CVE-2026-30879MEDIUMbaserCMS: Cross-site scripting vulnerability in blog postEPSS 0.2%CVE-2024-12037MEDIUMFrontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-37535HIGHHCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityEPSS 0.2%