Falhas do tipo CWE-79

30.524 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-25054HIGHn8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UIEPSS 0.2%CVE-2026-60664HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2025-68894HIGHWordPress ShoutOut plugin <= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68883HIGHWordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-60636HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2024-7083LOWEmail Encoder < 2.3.4 - Admin+ Stored XSSEPSS 0.2%CVE-2025-69320HIGHWordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-112207HIGHDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download LinkEPSS 0.2%CVE-2025-63442MEDIUMSimple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to pEPSS 0.2%CVE-2025-64260HIGHWordPress ANAC XML Bandi di Gara plugin <= 7.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-23858MEDIUMDell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site SEPSS 0.2%CVE-2025-68859HIGHWordPress Syntax Highlighter Compress plugin <= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69316HIGHWordPress TableOn plugin <= 1.0.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3617MEDIUMPaypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode AttributesEPSS 0.2%CVE-2025-2896MEDIUMIBM Planning Analytics Local cross-site scriptingEPSS 0.2%CVE-2026-2988MEDIUMBlubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast ShortcodesEPSS 0.2%CVE-2026-60638HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2025-12551HIGHWordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68906HIGHWordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-30564MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.2%