Falhas do tipo CWE-79

30.314 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-53907MEDIUMStored Cross‑Site Scripting in MCOEPSS 0.2%CVE-2026-1042MEDIUMWP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' ParametersEPSS 0.2%CVE-2025-15188MEDIUMCampcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scriptingEPSS 0.2%CVE-2025-56313MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). ThEPSS 0.2%CVE-2025-14663MEDIUMcode-projects Student File Management System update_student.php cross site scriptingEPSS 0.2%CVE-2025-10053MEDIUMTableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-46336MEDIUMkashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php.EPSS 0.2%CVE-2024-13898MEDIUMSimple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-95684HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' ParameterEPSS 0.2%CVE-2025-61997MEDIUMOPEXUS FOIAXpress stored XSS via banner imageEPSS 0.2%CVE-2025-41406MEDIUMCross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specificEPSS 0.2%CVE-2025-14887MEDIUMtwinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender SettingsEPSS 0.2%CVE-2026-103899HIGHEU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterEPSS 0.2%CVE-2026-101357MEDIUMSEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' ParameterEPSS 0.2%CVE-2026-102007HIGHBit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook CallbackEPSS 0.2%CVE-2026-2156MEDIUMcode-projects Online Student Management System Announcement Management index.php cross site scriptingEPSS 0.2%CVE-2025-62598MEDIUMWeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'EPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2026-116622HIGHFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' CookieEPSS 0.2%