Falhas do tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-10189MEDIUMBP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-65540MEDIUMMultiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields suEPSS 0.2%CVE-2026-24952MEDIUMWordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-61453MEDIUMGrav before 2.0.1 XSS via Twig String ConcatenationEPSS 0.2%CVE-2026-27156MEDIUMNiceGUI has XSS via Code InjectionEPSS 0.2%CVE-2026-116854MEDIUMWordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3217MEDIUMSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018EPSS 0.2%CVE-2026-32703CRITICALOpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security PolicyEPSS 0.2%CVE-2026-24958MEDIUMWordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67448HIGHThe SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize uEPSS 0.2%CVE-2025-10490MEDIUMZephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-22463MEDIUMWordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54704MEDIUMWordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4596MEDIUMprojectworlds Lawyer Management System lawyers.php cross site scriptingEPSS 0.2%CVE-2025-52710MEDIUMWordPress File Manager Pro plugin <= 1.8.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-12124MEDIUMFitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-12098MEDIUMPowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta FieldEPSS 0.2%CVE-2025-66444HIGHCross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center AnalyzerEPSS 0.2%CVE-2026-6095MEDIUMOrejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032EPSS 0.2%CVE-2026-25743HIGHOpenEMR has Stored XSS in Questionnaire answersEPSS 0.2%