Falhas do tipo CWE-79

30.528 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-27119MEDIUMSvelte affected by XSS in SSR `<option>` elementEPSS 0.2%CVE-2026-2266HIGHImproper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injectionEPSS 0.2%CVE-2026-100522MEDIUMCotonti through 1.0.0 Reflected XSS via message.php lng parameterEPSS 0.2%CVE-2026-109673HIGHFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record NamesEPSS 0.2%CVE-2025-62903MEDIUMWordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68566MEDIUMWordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14985MEDIUMAlpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post MetaEPSS 0.2%CVE-2025-69006MEDIUMWordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68574MEDIUMWordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-112039MEDIUMdiem-project diem Administrative Console actions.class.php append cross site scriptingEPSS 0.2%CVE-2026-94641HIGHWordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63033MEDIUMWordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-5647MEDIUMcode-projects Online Shoe Store Add Product admin_feature.php cross site scriptingEPSS 0.2%CVE-2026-36341MEDIUMCross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the coEPSS 0.2%CVE-2025-62012MEDIUMWordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4576MEDIUMcode-projects Exam Form Submission update_s5.php cross site scriptingEPSS 0.2%CVE-2026-116555MEDIUMArgilla Sandbox.vue cross site scriptingEPSS 0.2%CVE-2026-1146MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scriptingEPSS 0.2%CVE-2026-20894MEDIUMCross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administEPSS 0.2%CVE-2025-67630MEDIUMWordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%