Falhas do tipo CWE-79

30.316 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-96558HIGHQuiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' ParameterEPSS 0.2%CVE-2025-25625MEDIUMA stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and wEPSS 0.2%CVE-2025-4169MEDIUMPosts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43830MEDIUMStored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.QEPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%CVE-2026-100186HIGHUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name FieldEPSS 0.2%CVE-2025-8460MEDIUMA user with elevated privileges can inject XSS in the Notification rules configuration pageEPSS 0.2%CVE-2026-119162HIGHUser Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode SplittingEPSS 0.2%CVE-2024-56221MEDIUMWordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57292MEDIUMTodoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properEPSS 0.2%CVE-2026-96568HIGHRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' ParameterEPSS 0.2%CVE-2025-4055MEDIUMMultiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto ShortcodeEPSS 0.2%CVE-2025-63638MEDIUMSourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fEPSS 0.2%CVE-2025-65215MEDIUMSourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplierEPSS 0.2%CVE-2024-53287MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology EPSS 0.2%CVE-2026-40201MEDIUM@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.EPSS 0.2%CVE-2025-22281MEDIUMWordPress Simplish theme <= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27139MEDIUMCombodo iTop vulnerable to stored self Cross-site Scripting in preferencesEPSS 0.2%CVE-2026-93889HIGHMail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error MessageEPSS 0.2%CVE-2025-11927MEDIUMFlying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%