Falhas do tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-3742MEDIUMYiFang CMS D_singlePage.php update cross site scriptingEPSS 0.2%CVE-2026-27177MEDIUMMajorDoMo Stored Cross-Site Scripting via Property Set EndpointEPSS 0.2%CVE-2021-29669MEDIUMIBM Jazz Foundation cross-site scriptingEPSS 0.2%CVE-2021-47873MEDIUMVestaCP < 0.9.8-25 - Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-53569MEDIUMA stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authEPSS 0.2%CVE-2026-92411MEDIUMWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag NameEPSS 0.2%CVE-2025-52486MEDIUMDNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjectsEPSS 0.2%CVE-2025-28094MEDIUMshopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.EPSS 0.2%CVE-2026-3468MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralizatiEPSS 0.2%CVE-2026-87777MEDIUMHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget AttributeEPSS 0.2%CVE-2026-0587MEDIUMXinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scriptingEPSS 0.2%CVE-2026-85001MEDIUMEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle AttributeEPSS 0.2%CVE-2024-53568MEDIUMA stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticEPSS 0.2%CVE-2025-50976MEDIUMIPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME quEPSS 0.2%CVE-2025-60302MEDIUMcode-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details syEPSS 0.2%CVE-2025-57681MEDIUMThe WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users anEPSS 0.2%CVE-2025-26548HIGHWordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.2%CVE-2025-60304MEDIUMcode-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field.EPSS 0.2%CVE-2025-34262MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}EPSS 0.2%CVE-2025-53205HIGHWordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%