Falhas do tipo CWE-79

30.496 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-59997MEDIUMJunos Space: Fields in the CLI Configlets are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-47659MEDIUMWordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57875MEDIUMBUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2026-82160LOWDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-sEPSS 0.2%CVE-2025-55103MEDIUMBUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.EPSS 0.2%CVE-2025-60000MEDIUMJunos Space: Generate Report page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-59992MEDIUMJunos Space: Secure Console page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-55341MEDIUMCross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad.EPSS 0.2%CVE-2025-59985MEDIUMJunos Space: Purging Policy field is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-58822MEDIUMWordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-24672HIGHOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile FieldsEPSS 0.2%CVE-2026-4334MEDIUMShariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.2%CVE-2025-57874MEDIUMBUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)EPSS 0.2%CVE-2025-46542MEDIUMWordPress Xpert Tab plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-27351MEDIUMWordPress Local Search SEO Contact Page plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59987MEDIUMJunos Space: The arbitrary device search field is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-59986MEDIUMJunos Space: Input fields in Model Devices are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-60002MEDIUMJunos Space: Template Definitions page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2024-48624MEDIUMIn segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site ScrEPSS 0.2%CVE-2026-2583MEDIUMBlocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` FieldsEPSS 0.2%