Falhas do tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-37945MEDIUMWordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-96326HIGHHT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor FieldEPSS 0.2%CVE-2026-116851HIGHWordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115592HIGHWordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-12974MEDIUMXSS in Akinsoft's ProKuaförEPSS 0.2%CVE-2026-33739MEDIUMFOG has Stored XSS in Multiple Management PagesEPSS 0.2%CVE-2026-116847HIGHWordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-93886HIGHIBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUIEPSS 0.2%CVE-2025-67912MEDIUMWordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54740MEDIUMWordPress Print My Blog Plugin <= 3.27.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-55709MEDIUMWordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-87111HIGHUser Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer HeaderEPSS 0.2%CVE-2026-115611HIGHWordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13064MEDIUMXSS in Akinsoft's MyRezztaEPSS 0.2%CVE-2026-30695MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includEPSS 0.2%CVE-2025-11928MEDIUMCSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-112379HIGHWordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48251MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-47985MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-47935MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%