Falhas do tipo CWE-79

30.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-10727MEDIUMReflected XSS in ArkSigner's AcBakImzalaEPSS 0.2%CVE-2024-36064MEDIUMThe NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wiEPSS 0.2%CVE-2025-68658MEDIUMOpen Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name fieldEPSS 0.2%CVE-2026-34161MEDIUMChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript ExecutionEPSS 0.2%CVE-2026-92551MEDIUMPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename ParameterEPSS 0.2%CVE-2025-32300HIGHWordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67930HIGHWordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12109MEDIUMHeader Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-84096HIGHWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form FieldsEPSS 0.2%CVE-2025-69048HIGHWordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6365MEDIUMDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001EPSS 0.2%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.2%CVE-2025-69084HIGHWordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.2%CVE-2025-69085HIGHWordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69056HIGHWordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67922HIGHWordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120488MEDIUMLaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block ContentEPSS 0.2%CVE-2026-21904MEDIUMJunos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-31101MEDIUMWordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%