Falhas do tipo CWE-79

30.309 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-14887MEDIUMtwinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender SettingsEPSS 0.2%CVE-2026-87920HIGHW3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2026-109513HIGHNotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST RouteEPSS 0.2%CVE-2026-107742HIGH10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2025-14663MEDIUMcode-projects Student File Management System update_student.php cross site scriptingEPSS 0.2%CVE-2024-34568MEDIUMWordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41406MEDIUMCross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specificEPSS 0.2%CVE-2025-60318MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First NEPSS 0.2%CVE-2026-101357MEDIUMSEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' ParameterEPSS 0.2%CVE-2025-56313MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). ThEPSS 0.2%CVE-2025-31407MEDIUMWordPress Tiger theme <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-61997MEDIUMOPEXUS FOIAXpress stored XSS via banner imageEPSS 0.2%CVE-2024-52350MEDIUMWordPress CRM 2go plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-95670HIGHNo External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} RedirectEPSS 0.2%CVE-2024-46336MEDIUMkashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php.EPSS 0.2%CVE-2026-96871HIGHMang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' ParameterEPSS 0.2%CVE-2024-53288MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology REPSS 0.2%CVE-2026-97663HIGHCustomer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2025-40721MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.2%CVE-2026-63498HIGHSnipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIEPSS 0.2%