Falhas do tipo CWE-79

30.593 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-82387MEDIUMApache Roller: Stored cross-site scripting via uploaded media content typeEPSS 0.2%CVE-2025-37732MEDIUMKibana Cross-site Scripting via the Integration Package Upload FunctionalityEPSS 0.2%CVE-2025-66421MEDIUMTryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, EPSS 0.2%CVE-2026-14572MEDIUMKirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text ContentEPSS 0.2%CVE-2026-8895MEDIUMkk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-49384MEDIUMIn JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleEPSS 0.2%CVE-2026-82381MEDIUMApache Roller: Stored cross-site scripting in the authoring UIEPSS 0.2%CVE-2026-41661MEDIUMAdmidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionEPSS 0.2%CVE-2026-8039MEDIUMFancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-1820MEDIUMMedia Library Alt Text Editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode AttributeEPSS 0.2%CVE-2025-68898MEDIUMWordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62528MEDIUMTaguette cross-site scripting vulnerability via tag name, tag description, document name and document descriptionEPSS 0.2%CVE-2025-8308MEDIUMReflected XSS in Key Software's INFOREXEPSS 0.2%CVE-2026-36521MEDIUMPublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.EPSS 0.2%CVE-2025-68525MEDIUMWordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-37216MEDIUMRuoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.EPSS 0.2%CVE-2025-65134MEDIUMIn manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.phEPSS 0.2%CVE-2025-70846HIGHlty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password.EPSS 0.2%CVE-2026-8885MEDIUMDeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-0618MEDIUMCross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.EPSS 0.2%