Falhas do tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-57883MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, EPSS 0.2%CVE-2026-92746MEDIUMGutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' AttributeEPSS 0.2%CVE-2024-51222MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 alEPSS 0.2%CVE-2026-96743MEDIUMTable Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field ValueEPSS 0.2%CVE-2026-93908MEDIUMReal Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' ParameterEPSS 0.2%CVE-2026-31351MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execEPSS 0.2%CVE-2026-8977MEDIUMWP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX ActionEPSS 0.2%CVE-2025-51734MEDIUMCross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.EPSS 0.2%CVE-2026-100694MEDIUMHugo before 0.166.0 Cross-Site Scripting via text/orgEPSS 0.2%CVE-2026-33311MEDIUM@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized OptionsEPSS 0.2%CVE-2025-53504MEDIUMGroup-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vEPSS 0.2%CVE-2026-6073HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.2%CVE-2025-54407MEDIUMStored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, andEPSS 0.2%CVE-2026-3218MEDIUMResponsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019EPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2026-110384HIGHWordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62752MEDIUMWordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-79311MEDIUMwebpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().EPSS 0.2%CVE-2024-34321MEDIUMProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes pEPSS 0.2%CVE-2026-3004MEDIUMSnow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' AttributeEPSS 0.2%