Falhas do tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-64094MEDIUMDNN vulnerable to stored cross-site-scripting (XSS) via SVG uploadEPSS 0.2%CVE-2026-103520MEDIUMHivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML FormatEPSS 0.2%CVE-2026-97077HIGHWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-5506MEDIUMWavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-95515HIGHWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7390MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php customer cross site scriptingEPSS 0.2%CVE-2026-5711MEDIUMPost Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block AttributeEPSS 0.2%CVE-2026-114229—Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionEPSS 0.2%CVE-2026-34206MEDIUMCaptcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/templateEPSS 0.2%CVE-2025-13056MEDIUMA user with elevated privileges can inject XSS in the Administration ACL Menus configuration pageEPSS 0.2%CVE-2026-93656MEDIUMUser Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar FieldEPSS 0.2%CVE-2023-5648MEDIUMIn Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unautEPSS 0.2%CVE-2025-3153MEDIUMConcrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeEPSS 0.2%CVE-2026-96836HIGHWordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110017MEDIUMQuick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode AttributeEPSS 0.2%CVE-2025-43742MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QEPSS 0.2%CVE-2026-12241MEDIUMAdvanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-6809MEDIUMSocial Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads EmbedEPSS 0.2%CVE-2026-42650HIGHWordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6800MEDIUMFastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%