Falhas do tipo CWE-79

30.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-3295HIGHIBM Cloud Pak System Cross-Site ScriptingEPSS 0.2%CVE-2025-61648NONEStored XSS through system messages in CheckUserEPSS 0.2%CVE-2025-58984MEDIUMWordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-36173MEDIUMInfoSphere Data Architect (IDA) 9.2.1 Vulnerability Fixes.EPSS 0.2%CVE-2025-68917MEDIUMONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.EPSS 0.2%CVE-2025-49042MEDIUMWordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-107422MEDIUMWordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-79363MEDIUMCloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administraEPSS 0.2%CVE-2025-55033MEDIUMDrag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectlyEPSS 0.2%CVE-2025-58216MEDIUMWordPress WP Thumbtack Review Slider Plugin <= 2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48494MEDIUMGokapi vulnerable to stored XSS via uploading file with malicious file nameEPSS 0.2%CVE-2025-58625MEDIUMWordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58983MEDIUMWordPress Include Me Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-3010CRITICALTimePictra Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-36172MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF002EPSS 0.2%CVE-2026-40229MEDIUMHelpy 2.8.0 - Stored XSS in post author display via PostsHelperEPSS 0.2%CVE-2026-39400MEDIUMStored XSS via Job HTML/Table Output in CronicleEPSS 0.2%CVE-2025-68709MEDIUMSailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMaEPSS 0.2%CVE-2025-62042MEDIUMWordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34889MEDIUMWordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%