Falhas do tipo CWE-79

30.587 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-25557MEDIUMEvoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameterEPSS 0.2%CVE-2026-63355MEDIUMAffected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theEPSS 0.2%CVE-2026-4920MEDIUMNext Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode AttributeEPSS 0.2%CVE-2026-24979HIGHWordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47951MEDIUMWordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URLEPSS 0.2%CVE-2026-36763MEDIUMA stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to exEPSS 0.2%CVE-2024-10031MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unEPSS 0.2%CVE-2026-1711MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%CVE-2024-7860MEDIUMSimple Headline Rotator <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2022-50960MEDIUMWordPress International Sms Contact Form 7 Integration 1.2 XSSEPSS 0.2%CVE-2026-63351MEDIUMAffected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before EPSS 0.2%CVE-2026-25351HIGHWordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-23973HIGHWordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103846HIGHDimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)EPSS 0.2%CVE-2021-47950MEDIUMAdvanced Guestbook 2.4.4 Persistent XSS via SmiliesEPSS 0.2%CVE-2024-7822MEDIUMQuick Code <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2026-4859MEDIUMSP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' AttributeEPSS 0.2%CVE-2026-6237MEDIUMQuick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode AttributeEPSS 0.2%CVE-2026-6256MEDIUMCredits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.2%CVE-2026-3877HIGHReflected Cross-Site Scripting in Dashboard SearchEPSS 0.2%