Falhas do tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-49061MEDIUMWordPress Porn Videos Embed plugin <= 0.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49909HIGHWordPress Penci Bookmark & Follow plugin < 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62036HIGHWordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48527HIGHHaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpointEPSS 0.2%CVE-2026-119211MEDIUMAAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' HookEPSS 0.2%CVE-2025-3704MEDIUMWordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48154HIGHWordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-63317MEDIUMTodoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JEPSS 0.2%CVE-2025-49904HIGHWordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-24641HIGHWordPress Better WishList API plugin <= 1.1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-56243MEDIUMA Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the eventEPSS 0.2%CVE-2025-34258MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/planEPSS 0.2%CVE-2025-56807MEDIUMA cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScEPSS 0.2%CVE-2025-55620MEDIUMA cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbEPSS 0.2%CVE-2026-34694MEDIUMAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-105077HIGHWordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13141MEDIUMHT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute InjectionEPSS 0.2%CVE-2025-23788HIGHWordPress Easy Filter Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-44708MEDIUMMistune Math Plugin XSS Escape BypassEPSS 0.2%CVE-2026-121765HIGHWordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%