Falhas do tipo CWE-79

30.370 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-95817HIGHDoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2025-46932MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-22797MEDIUMWordPress Gallery and Lightbox plugin <= 1.0.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47716MEDIUMOrangescrum 1.8.0 Cross-Site Scripting via Authenticated EndpointsEPSS 0.2%CVE-2026-6690HIGHLifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX ActionEPSS 0.2%CVE-2025-50046MEDIUMWordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22354MEDIUMWordPress Digi Store theme <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23943MEDIUMWordPress PDF.js Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-81635MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of aEPSS 0.2%CVE-2025-50037MEDIUMWordPress Buying Buddy IDX CRM plugin <= 2.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-46998MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-20258HIGHStored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk EnterpriseEPSS 0.2%CVE-2026-25642MEDIUMHedgeDoc security headers for uploaded files were not workingEPSS 0.2%CVE-2025-50047MEDIUMWordPress Sitekit plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-111122HIGHSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual InspectorEPSS 0.2%CVE-2025-23950MEDIUMWordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53276MEDIUMWordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-37247MEDIUMWordPress jQuery T(-) Countdown Widget plugin <= 2.3.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31883MEDIUMWordPress WebinarPress plugin <= 1.33.28 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27825MEDIUMAn XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class EPSS 0.2%