Falhas do tipo CWE-79

30.470 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-11922MEDIUMInput Validation vulnerability in Web Client emails that do not go through Secure MailEPSS 0.2%CVE-2025-63064MEDIUMWordPress EventON plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46229MEDIUMWordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2021-47934MEDIUMMyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRFEPSS 0.2%CVE-2025-43804MEDIUMCross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1EPSS 0.2%CVE-2026-0749MEDIUMCross-Site Scripting Vulnerability in Drupal Form Builder ModuleEPSS 0.2%CVE-2026-3466HIGHCross-site scripting in dashlet titleEPSS 0.2%CVE-2025-22675MEDIUMWordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25647MEDIUMLute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlinkEPSS 0.2%CVE-2025-31471MEDIUMWordPress Duplicate Page and Post plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13975MEDIUMContact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' SettingsEPSS 0.2%CVE-2025-53397MEDIUMAdvantech iView Cross-site ScriptingEPSS 0.2%CVE-2025-22662MEDIUMWordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-33368MEDIUMZimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST intEPSS 0.2%CVE-2025-43781MEDIUMReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.EPSS 0.2%CVE-2025-14054MEDIUMWC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode AttributeEPSS 0.2%CVE-2025-43779MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.QEPSS 0.2%CVE-2026-2489MEDIUMTP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' TextareaEPSS 0.2%CVE-2025-58821MEDIUMWordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24591MEDIUMWordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%