Falhas do tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-3577MEDIUMKeep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup TitleEPSS 0.2%CVE-2025-50584MEDIUMStudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Teacher module.EPSS 0.2%CVE-2025-68887HIGHWordPress WP-BusinessDirectory plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47669MEDIUMWordPress CBX Map for Google Map & OpenStreetMap plugin <= 1.1.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-47686MEDIUMWordPress DELUCKS SEO plugin <= 2.5.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-11799HIGHUXSS in Focus for iOS / Klar Webkit navigationEPSS 0.2%CVE-2025-65230MEDIUMBarix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming DestinatEPSS 0.2%CVE-2025-9332MEDIUMInteractive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-23608HIGHWordPress LIVE TV plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-90906MEDIUMJoomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3EPSS 0.2%CVE-2025-14119MEDIUMApp Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-14147MEDIUMEasy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.2%CVE-2025-41038MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-50581MEDIUMMRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.EPSS 0.2%CVE-2025-7439MEDIUMAnber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button linkEPSS 0.2%CVE-2026-85081HIGHMultiple elFinder Plugins - DOM-based XSS via postMessage Origin BypassEPSS 0.2%CVE-2025-48135MEDIUMWordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-50583MEDIUMStudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Student module.EPSS 0.2%CVE-2026-2121MEDIUMWeaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget SettingEPSS 0.2%CVE-2025-14343HIGHReflected XSS in Dokuzsoft Technology's E-Commerce ProductEPSS 0.2%