Falhas do tipo CWE-79

30.525 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-7496MEDIUMWPC Smart Compare for WooCommerce <= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-120636—CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formEPSS 0.2%CVE-2025-2483MEDIUMGift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address ParameterEPSS 0.2%CVE-2026-6107MEDIUM1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scriptingEPSS 0.2%CVE-2025-49074MEDIUMWordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48230MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple POST ParametersEPSS 0.2%CVE-2025-47578MEDIUMWordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-20304MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker EPSS 0.2%CVE-2026-48216MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST ParametersEPSS 0.2%CVE-2025-48131MEDIUMWordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-52796HIGHWordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-12137MEDIUMSysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' ParameterEPSS 0.2%CVE-2026-2512MEDIUMCode Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.2%CVE-2025-52727HIGHWordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-52798HIGHWordPress JobSearch plugin < 3.0.6 - Reflected Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-52778HIGHWordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-109565MEDIUMRapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list ComponentEPSS 0.2%CVE-2026-85492MEDIUMAll in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL PathnameEPSS 0.2%CVE-2025-14445MEDIUMImage Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field MetaEPSS 0.2%CVE-2026-92243MEDIUMIvory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' ParameterEPSS 0.2%