Falhas do tipo CWE-79

30.495 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-71275MEDIUMOpenBK7231T - Reflected XSS via OTA host ParameterEPSS 0.2%CVE-2025-43769MEDIUMStored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024EPSS 0.2%CVE-2025-22635HIGHWordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-13712MEDIUMDivi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URLEPSS 0.2%CVE-2025-69003HIGHWordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4770MEDIUMDOM-Based XSS in TR7's WAF-ASPEPSS 0.2%CVE-2024-13642MEDIUMStratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot WidgetEPSS 0.2%CVE-2025-48323MEDIUMWordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3862MEDIUMCross-Site Scripting Vulnerability in SiteMinder Administrative UIEPSS 0.2%CVE-2024-25812MEDIUMMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.EPSS 0.2%CVE-2025-55126MEDIUMHackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertEPSS 0.2%CVE-2025-15249MEDIUMzhujunliang3 work_platform Content cross site scriptingEPSS 0.2%CVE-2026-24576MEDIUMWordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60131MEDIUMWordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-60146MEDIUMWordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-43822MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2EPSS 0.2%CVE-2024-25814MEDIUMMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.EPSS 0.2%CVE-2026-85293MEDIUMInvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsEPSS 0.2%CVE-2026-75916CRITICALSiYuan XSS-to-RCE via unescaped block metadata in hint popupEPSS 0.2%CVE-2025-58596MEDIUMWordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%