Falhas do tipo CWE-79

30.537 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-66460MEDIUMLookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to DatatablesEPSS 0.2%CVE-2025-53222HIGHWordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-61431MEDIUMA reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and InfinitEPSS 0.2%CVE-2025-6396MEDIUMXSS in Webbeyaz's web siteEPSS 0.2%CVE-2025-68978MEDIUMWordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7296MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scriptingEPSS 0.2%CVE-2025-14274MEDIUMUnlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero WidgetEPSS 0.2%CVE-2025-63885MEDIUMA stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via inEPSS 0.2%CVE-2025-49389MEDIUMWordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54050MEDIUMWordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-8136MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingEPSS 0.2%CVE-2025-54965MEDIUMAn XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameteEPSS 0.2%CVE-2025-26258MEDIUMSourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'EPSS 0.2%CVE-2025-50733MEDIUMNextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute EPSS 0.2%CVE-2025-61933MEDIUMBIG-IP APM cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-108934MEDIUMEdimax BR-6208AC HTTP Blocking formUrlb cross site scriptingEPSS 0.2%CVE-2025-12083MEDIUMCivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113EPSS 0.2%CVE-2025-10955MEDIUMHTML Injection in Netcad Software's NetigmaEPSS 0.2%CVE-2026-36358MEDIUMCross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the AdEPSS 0.2%CVE-2024-45753MEDIUMIn Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribuEPSS 0.2%