Falhas do tipo CWE-79

30.509 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-103424MEDIUMAnti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy RegexEPSS 0.2%CVE-2025-53519MEDIUMAdvantech iView Cross-site ScriptingEPSS 0.2%CVE-2026-8627MEDIUMCorrect Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF ParameterEPSS 0.2%CVE-2025-36125MEDIUMIBM Hardware Management Console - Power Systems cross-site scriptingEPSS 0.2%CVE-2026-36470MEDIUMCuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTMEPSS 0.2%CVE-2025-67978HIGHWordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-50182MEDIUMAVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationEPSS 0.2%CVE-2026-27121MEDIUMSvelte affected by cross-site scripting via spread attributes in Svelte SSREPSS 0.2%CVE-2025-40708MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2025-57407MEDIUMA stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to injecEPSS 0.2%CVE-2025-56605MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0EPSS 0.2%CVE-2025-10146MEDIUMDownload Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` ParameterEPSS 0.2%CVE-2026-13977MEDIUMInappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or EPSS 0.2%CVE-2025-1261MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown WidgetEPSS 0.2%CVE-2025-8897MEDIUMBeaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-39363MEDIUMWordPress Custom Login and Registration <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27578HIGHn8n Vulnerable to Stored XSS via Various NodesEPSS 0.2%CVE-2025-40706MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2026-9104MEDIUMDraft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post TitleEPSS 0.2%CVE-2025-12193MEDIUMMang Board WP <= 2.3.1 - Reflected Cross-Site ScriptingEPSS 0.2%