Falhas do tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-109985MEDIUMxSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterEPSS 0.2%CVE-2026-101925MEDIUMbbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display NameEPSS 0.2%CVE-2026-100158MEDIUMSQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User FieldEPSS 0.2%CVE-2025-60934MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 aEPSS 0.2%CVE-2026-31013MEDIUMDovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhoneboEPSS 0.2%CVE-2026-4766MEDIUMEasy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post MetaEPSS 0.2%CVE-2026-116836HIGHA malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulneraEPSS 0.2%CVE-2026-0894MEDIUMContent Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block ShortcodeEPSS 0.2%CVE-2025-59765MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-76580MEDIUMImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (EPSS 0.2%CVE-2026-2002MEDIUMForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-35608MEDIUMQuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript executionEPSS 0.2%CVE-2025-59770MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-52217MEDIUMSelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied inpEPSS 0.2%CVE-2025-64048MEDIUMYCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in thEPSS 0.2%CVE-2025-67202MEDIUMSidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craftEPSS 0.2%CVE-2025-59763MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59769MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-42877MEDIUMFacturaScripts: Stored XSS via product reference in sales/purchasesEPSS 0.2%CVE-2025-10346MEDIUMHTML injection in Perfex CRMEPSS 0.2%