Falhas do tipo CWE-79

30.508 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-34598HIGHYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"EPSS 0.2%CVE-2026-35008MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id ParameterEPSS 0.2%CVE-2025-67984HIGHWordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119218MEDIUMGreenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefixEPSS 0.2%CVE-2023-37508LOWHCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-2396MEDIUMList View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event DescriptionEPSS 0.2%CVE-2025-68863HIGHWordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-2404MEDIUMXSS in Ubit Information Technologies' STOYSEPSS 0.2%CVE-2025-69302HIGHWordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-46241MEDIUMPHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php andEPSS 0.2%CVE-2026-120019MEDIUMW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify PlaceholderEPSS 0.2%CVE-2026-22678MEDIUMWebmin < 2.641 Stored XSS via System and Server StatusEPSS 0.2%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.2%CVE-2026-35009MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id ParameterEPSS 0.2%CVE-2024-57278MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused EPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-63171MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Category DescriptionEPSS 0.2%CVE-2026-110802MEDIUMAltair: DOM-based XSS via attacker-controlled script URLs in the iframe sandboxEPSS 0.2%CVE-2026-11878HIGHReflected Cross-Site Scripting vulnerability in OpenText Access ManagerEPSS 0.2%