Falhas do tipo CWE-79

30.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-107765MEDIUMDiscussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) FieldEPSS 0.2%CVE-2026-122222MEDIUMPermalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post SlugEPSS 0.2%CVE-2025-6988MEDIUMKallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-3837MEDIUMFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field FormattersEPSS 0.2%CVE-2025-11897MEDIUMThe7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'EPSS 0.2%CVE-2026-118204MEDIUMWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column RendererEPSS 0.2%CVE-2025-10295MEDIUMAngel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-21632MEDIUMJoomla! Core - [20260304] - XSS vectors in various article title outputsEPSS 0.2%CVE-2025-48470MEDIUMStored Cross site Scripting (XSS)EPSS 0.2%CVE-2026-60650HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2025-12151MEDIUMSimple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11859MEDIUMPaypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-55056MEDIUMA stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-formEPSS 0.2%CVE-2026-32124MEDIUMOpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)EPSS 0.2%CVE-2025-12711MEDIUMShare to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google ShortcodeEPSS 0.2%CVE-2025-52037MEDIUMA vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The EPSS 0.2%CVE-2026-109974MEDIUMAll-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode AttributeEPSS 0.2%CVE-2026-111592MEDIUMCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term nameEPSS 0.2%CVE-2025-12324MEDIUMTablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-36019MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%