Falhas do tipo CWE-79

30.371 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-44387MEDIUMELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerabilityEPSS 0.2%CVE-2026-109995HIGHAdvanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2025-23934MEDIUMWordPress Giveaways and Contests by PromoSimple plugin <= 1.24 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53282MEDIUMWordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-46998MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-102831HIGHJupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardEPSS 0.2%CVE-2024-37247MEDIUMWordPress jQuery T(-) Countdown Widget plugin <= 2.3.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97661HIGHBusiness Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form FieldEPSS 0.2%CVE-2025-46852MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-50037MEDIUMWordPress Buying Buddy IDX CRM plugin <= 2.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-23951MEDIUMWordPress Gallery: Hybrid – Advanced Visual Gallery plugin <= 1.4.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50047MEDIUMWordPress Sitekit plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22761MEDIUMWordPress Ajax Contact Form plugin <= 1.4.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1055MEDIUMTalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' ParameterEPSS 0.2%CVE-2023-53890MEDIUMPerch CMS 3.2 Stored Cross-Site Scripting via SVG File UploadEPSS 0.2%CVE-2025-23933MEDIUMWordPress WpF Ultimate Carousel plugin <= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53276MEDIUMWordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23947MEDIUMWordPress WP-Player plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-77838MEDIUMSOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logginEPSS 0.2%CVE-2025-61306MEDIUMA reflected cross-site scripted (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docuEPSS 0.2%