Falhas do tipo CWE-79

30.495 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-68900MEDIUMWordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48352MEDIUMWordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60101MEDIUMWordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-56451MEDIUMCross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/mainEPSS 0.2%CVE-2025-62240MEDIUMMultiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.EPSS 0.2%CVE-2025-49392MEDIUMWordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-92826MEDIUMEWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter KeyEPSS 0.2%CVE-2026-2728MEDIUMLibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploEPSS 0.2%CVE-2025-24841MEDIUMMovable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 EPSS 0.2%CVE-2025-62899MEDIUMWordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60154MEDIUMWordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60133MEDIUMWordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-57755MEDIUMWordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57373MEDIUMWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-0588MEDIUMXinhu Rainrock RockOA API rockfun.php cross site scriptingEPSS 0.2%CVE-2025-11950MEDIUMReflected XSS in Knowhy's EduAsistEPSS 0.2%CVE-2026-66703MEDIUMWordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-65233MEDIUMReflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/syscoEPSS 0.2%CVE-2026-65480MEDIUMWordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-30084MEDIUMExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for JoomlaEPSS 0.2%