Falhas do tipo CWE-79

30.525 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-1439MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-9809HIGHA stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers onEPSS 0.2%CVE-2025-7056MEDIUMStored XSS in UrlShortenerEPSS 0.2%CVE-2026-60634HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2025-52169HIGHagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.EPSS 0.2%CVE-2025-68884HIGHWordPress WP Simple Redirect plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46262MEDIUMWordPress Mad Mimi for WordPress plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36248MEDIUMIBM Copy Services Manager cross-site scriptingEPSS 0.2%CVE-2026-26281MEDIUMInvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice ViewEPSS 0.2%CVE-2025-40991MEDIUMStored XSS in Creativeitem Ekushey CRMEPSS 0.2%CVE-2025-40694MEDIUMCross Site Scripting in PHPGurukul Online Fire Reporting SystemEPSS 0.2%CVE-2025-40695MEDIUMCross Site Scripting in PHPGurukul Online Fire Reporting SystemEPSS 0.2%CVE-2024-9993MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar WidgetEPSS 0.2%CVE-2026-48214MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id ParameterEPSS 0.2%CVE-2025-7661MEDIUMPartnerský systém Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-48121MEDIUMWordPress WP Notes Widget plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-108514MEDIUMDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016EPSS 0.2%CVE-2025-40693MEDIUMCross Site Scripting in PHPGurukul Online Fire Reporting SystemEPSS 0.2%CVE-2025-49076MEDIUMWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48220MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str ParameterEPSS 0.2%