Falhas do tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-57462MEDIUMStored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fiEPSS 0.2%CVE-2025-65120MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, EPSS 0.2%CVE-2025-62095MEDIUMWordPress Bootstrap Modals plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-58319MEDIUMKentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSSEPSS 0.2%CVE-2026-2827MEDIUMOpen User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'EPSS 0.2%CVE-2026-100238MEDIUMFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSEPSS 0.2%CVE-2026-109344MEDIUMDOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize HooksEPSS 0.2%CVE-2025-29231MEDIUMA stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrarEPSS 0.2%CVE-2024-34326MEDIUMProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MEPSS 0.2%CVE-2025-62752MEDIUMWordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%CVE-2026-67075MEDIUMHCL Digital Experience is affected by improper input sanitationEPSS 0.2%CVE-2026-4730MEDIUMCharts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode AttributeEPSS 0.2%CVE-2025-49358MEDIUMWordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-8893MEDIUMExpress Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-68867MEDIUMWordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104726MEDIUMName Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeEPSS 0.2%CVE-2025-63032MEDIUMWordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-34321MEDIUMProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes pEPSS 0.2%