Falhas do tipo CWE-79

30.315 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-25625MEDIUMA stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and wEPSS 0.2%CVE-2025-63638MEDIUMSourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fEPSS 0.2%CVE-2026-111111HIGHPrime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-EscapeEPSS 0.2%CVE-2025-4591MEDIUMWeluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-4055MEDIUMMultiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto ShortcodeEPSS 0.2%CVE-2026-58519MEDIUMStored XSS through Cargo's map formatEPSS 0.2%CVE-2025-63639MEDIUMThe chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to impropeEPSS 0.2%CVE-2024-56224MEDIUMWordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53287MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology EPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2026-97342HIGHJetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post ActionEPSS 0.2%CVE-2025-23079MEDIUMXSSes in Extension:ArticleFeedbackv5EPSS 0.2%CVE-2026-96558HIGHQuiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' ParameterEPSS 0.2%CVE-2026-96568HIGHRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' ParameterEPSS 0.2%CVE-2026-100186HIGHUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name FieldEPSS 0.2%CVE-2026-110530HIGHFeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed ContentEPSS 0.2%CVE-2025-2874MEDIUMUser Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-61996MEDIUMOPEXUS FOIAXpress stored XSS via annual report templateEPSS 0.2%CVE-2026-94573HIGHRepeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field ValueEPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%