Falhas do tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-34237MEDIUMAdvantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()EPSS 0.2%CVE-2026-118500MEDIUMCool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id ParameterEPSS 0.2%CVE-2025-8615MEDIUMCubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy ShortcodeEPSS 0.2%CVE-2025-65640MEDIUMCross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improEPSS 0.2%CVE-2026-41063MEDIUMWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)EPSS 0.2%CVE-2025-68889HIGHWordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64070MEDIUMSourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.EPSS 0.2%CVE-2025-8779MEDIUMAll-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown WidgetsEPSS 0.2%CVE-2025-34263MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menusEPSS 0.2%CVE-2025-48132MEDIUMWordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13839MEDIUMLJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode AttributeEPSS 0.2%CVE-2026-90906MEDIUMJoomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3EPSS 0.2%CVE-2025-46536MEDIUMWordPress Carousel-of-post-images plugin <= 1.07 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48135MEDIUMWordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-50581MEDIUMMRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.EPSS 0.2%CVE-2026-118054MEDIUMLearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' ParameterEPSS 0.2%CVE-2025-13906MEDIUMWP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-41038MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-57244MEDIUMOpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field acEPSS 0.2%CVE-2025-63645MEDIUMA stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. UnEPSS 0.2%