Falhas do tipo CWE-79

30.536 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-0499MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2026-39540MEDIUMWordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39788MEDIUMWordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114178HIGHWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14875MEDIUMHBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' ParameterEPSS 0.2%CVE-2026-84915MEDIUMComponent blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123EPSS 0.2%CVE-2026-1513MEDIUMbillboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.EPSS 0.2%CVE-2026-25343MEDIUMWordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-47977MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-47958MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-47936MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-24392MEDIUMWordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-47950MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-47962MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-49866HIGHWordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-42656MEDIUMWordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27273MEDIUMWordPress Affiliate Links Manager Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104587MEDIUMblob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead EPSS 0.2%CVE-2025-68268MEDIUMIn JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageEPSS 0.2%CVE-2026-48297MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%