Falhas do tipo CWE-79

30.536 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-67552MEDIUMWordPress Walker Core plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62913MEDIUMWordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49908MEDIUMWordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64194MEDIUMWordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58070MEDIUMPleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitraryEPSS 0.2%CVE-2026-111844MEDIUMWordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62948MEDIUMWordPress Date counter plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67545MEDIUMWordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68915MEDIUMRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.EPSS 0.2%CVE-2025-54806MEDIUMGROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while lEPSS 0.2%CVE-2025-62951MEDIUMWordPress H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51226MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System EPSS 0.2%CVE-2025-62917MEDIUMWordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7437MEDIUMAzonPost <= 1.3 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-28263MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release verEPSS 0.2%CVE-2026-1450MEDIUMrognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' ParameterEPSS 0.2%CVE-2026-41003HIGHUnencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingEPSS 0.2%CVE-2026-119365MEDIUMWordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47947MEDIUMProjectsend r1295 Stored Cross-Site Scripting via files-edit.phpEPSS 0.2%CVE-2024-58394MEDIUMRetool < 3.88.0 XSS via /api/imageProxy SVG ProxyingEPSS 0.2%