Falhas do tipo CWE-79

30.601 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-104479MEDIUMShopclass before 6.2.0 Stored XSS via Listing Description FieldEPSS 0.2%CVE-2026-95166MEDIUMIn Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.EPSS 0.2%CVE-2025-58208MEDIUMWordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-48540MEDIUMKrayin CRM 2.2.6 Stored Template Injection XSS via Lead TitleEPSS 0.2%CVE-2025-62759MEDIUMWordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58212MEDIUMWordPress Epeken All Kurir Plugin <= 2.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58987MEDIUMWordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-48228MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id ParametersEPSS 0.2%CVE-2025-58209MEDIUMWordPress Transcoder Plugin <= 1.4.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-10553HIGHStored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2025-62761MEDIUMWordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58875MEDIUMWordPress WP Github Gist Plugin <= 0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-63081MEDIUMPerfect Support Ticketing System 1.7 Stored XSS via Ticket Notes FieldEPSS 0.2%CVE-2025-58213MEDIUMWordPress Booking System Trafft Plugin <= 1.0.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58871MEDIUMWordPress Master Paper Collapse Toggle Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58874MEDIUMWordPress StoryMap Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58882MEDIUMWordPress Simple Text Slider Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68532MEDIUMWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48999MEDIUMStored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE productEPSS 0.2%CVE-2025-58205MEDIUMWordPress ElementInvader Addons for Elementor Plugin <= 1.3.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%