Falhas do tipo CWE-79

30.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-25453MEDIUMWordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-47760HIGHTinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGsEPSS 0.2%CVE-2026-37503MEDIUMCross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in pEPSS 0.2%CVE-2026-108815MEDIUMidcCMS member_deal.php cross site scriptingEPSS 0.2%CVE-2026-25432MEDIUMWordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-30578MEDIUMFile Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invEPSS 0.2%CVE-2026-32430MEDIUMWordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7110MEDIUMcode-projects Invoice System in Laravel item cross site scriptingEPSS 0.2%CVE-2025-53307HIGHWordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-30579MEDIUMFile Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a fiEPSS 0.2%CVE-2026-8656MEDIUMVersions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper EPSS 0.2%CVE-2026-118549HIGHAI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269EPSS 0.2%CVE-2026-100880MEDIUMzhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scriptingEPSS 0.2%CVE-2026-32411MEDIUMWordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25307MEDIUMWordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-105099MEDIUMOmega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scriptingEPSS 0.2%CVE-2026-31918MEDIUMWordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32424MEDIUMWordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102264MEDIUMmwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scriptingEPSS 0.2%CVE-2025-64224HIGHWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%