Falhas do tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-94078HIGHWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-100108MEDIUMSocial Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingEPSS 0.2%CVE-2026-79816MEDIUMUnauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client InterfaceEPSS 0.2%CVE-2026-93747MEDIUMwpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile FieldEPSS 0.2%CVE-2026-9019MEDIUMEasy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' ParametersEPSS 0.2%CVE-2026-100311MEDIUMmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scriptingEPSS 0.2%CVE-2026-41318MEDIUMAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentEPSS 0.2%CVE-2026-107748MEDIUMUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterEPSS 0.2%CVE-2026-102401MEDIUMDownload Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode AttributeEPSS 0.2%CVE-2025-12513MEDIUMA user with elevated privileges can inject XSS in the Hosts configuration parameters pageEPSS 0.2%CVE-2024-4867MEDIUMCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalEPSS 0.2%CVE-2025-60936MEDIUMEmoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API accesEPSS 0.2%CVE-2025-54890MEDIUMA user with elevated privileges can inject XSS in the Hostgroups configuration pageEPSS 0.2%CVE-2026-6551MEDIUMTimeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block AttributeEPSS 0.2%CVE-2026-16776MEDIUMMP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-33403MEDIUMPi-hole has a Reflected XSS / HTML injection in taillog.jsEPSS 0.2%CVE-2026-6648MEDIUMQibo CMS Internal Message cross site scriptingEPSS 0.2%CVE-2026-93770HIGHWordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51225MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 EPSS 0.2%CVE-2026-96766MEDIUMGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' ParameterEPSS 0.2%