Falhas do tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-53482MEDIUMIPInfo: Message key XSS through several IPInfo messages in infobox and popupEPSS 0.2%CVE-2025-43771MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DEPSS 0.2%CVE-2025-36563MEDIUMReflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an EPSS 0.2%CVE-2021-47725MEDIUMSTVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files ParameterEPSS 0.2%CVE-2025-6378MEDIUMResponsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus ShortcodeEPSS 0.2%CVE-2025-20328MEDIUMA vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privilegEPSS 0.2%CVE-2025-13744HIGHImproper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLEPSS 0.2%CVE-2026-25133MEDIUMOctober CMS has Stored XSS via SVG Filter BypassEPSS 0.2%CVE-2025-67723MEDIUMDiscourse vulnerable to stored Cross-site Scripting via Katex in discourse-math pluginEPSS 0.2%CVE-2025-4284MEDIUMReflected XSS in Rolantis Information Technologies' AgentisEPSS 0.2%CVE-2025-20356MEDIUMCisco CyberVision Center Sensor Explorer Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-121515MEDIUMFV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2025-43787MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 202EPSS 0.2%CVE-2026-2029MEDIUMLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode AttributesEPSS 0.2%CVE-2025-53121MEDIUMStored XSS in multiple 33.0.8files in opennms/opennmsEPSS 0.2%CVE-2025-52782HIGHWordPress Scroll UP plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53488MEDIUMStored XSS in WikiHieroEPSS 0.2%CVE-2026-0563MEDIUMWP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' ShortcodeEPSS 0.2%CVE-2025-50869MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input EPSS 0.2%CVE-2025-41439MEDIUMA reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vuEPSS 0.2%