Falhas do tipo CWE-79

30.316 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-58519MEDIUMStored XSS through Cargo's map formatEPSS 0.2%CVE-2025-63639MEDIUMThe chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to impropeEPSS 0.2%CVE-2026-77871MEDIUMPost Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-94573HIGHRepeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field ValueEPSS 0.2%CVE-2026-108566MEDIUMInstantSoft icms2 Private Message index.tpl.php index cross site scriptingEPSS 0.2%CVE-2025-4591MEDIUMWeluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14467MEDIUMWP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description FieldEPSS 0.2%CVE-2025-26514MEDIUMCVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)EPSS 0.2%CVE-2026-97641HIGHRelevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2026-96752HIGHZero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 IntegrationEPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2024-56231MEDIUMWordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-45002MEDIUMVigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile.EPSS 0.2%CVE-2026-65557MEDIUMWordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66475MEDIUMWordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-39595MEDIUM[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and SimulationEPSS 0.2%CVE-2024-4754MEDIUMStored XSS in Next4Biz's BPMEPSS 0.2%CVE-2026-106033MEDIUMAnsible: ansible-ui: ansible ui dom xss in /redirect next parameterEPSS 0.2%CVE-2026-119680HIGHStored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart FeatureEPSS 0.2%CVE-2024-8750MEDIUMCross-site Scripting vulnerability in Idoit proEPSS 0.2%