Falhas do tipo CWE-79

30.537 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-115596HIGHWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-67103HIGHHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-10931LOWUmami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109EPSS 0.2%CVE-2026-115612HIGHWordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41027MEDIUMMultiple vulnerabilities in GDTallerEPSS 0.2%CVE-2026-112869HIGHWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2099MEDIUMFlowring｜AgentFlow - Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-66359HIGHAn issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads tEPSS 0.2%CVE-2026-116621MEDIUMUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile FieldEPSS 0.2%CVE-2022-23961MEDIUMIn Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited byEPSS 0.2%CVE-2025-66484MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2026-24620MEDIUMWordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8082MEDIUMVuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'EPSS 0.2%CVE-2023-53738MEDIUMKentico Xperience <= 13.0.109 Page Preview Reflected XSSEPSS 0.2%CVE-2026-112844HIGHWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.2%CVE-2026-32859MEDIUMByteDance DeerFlow Stored XSS via Inline Artifact RenderingEPSS 0.2%CVE-2025-57700HIGHStored Cross-site Scripting in DIAEnergieEPSS 0.2%CVE-2025-67263MEDIUMAbacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The applicatiEPSS 0.2%CVE-2025-25063MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG imEPSS 0.2%