Falhas do tipo CWE-79

30.601 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-104656HIGHCross-site Scripting in Progress Telerik Fiddler EverywhereEPSS 0.2%CVE-2026-109131MEDIUMAnsible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)EPSS 0.2%CVE-2022-50685MEDIUMKentico Xperience <= 13.0.56 File Upload Stored XSSEPSS 0.2%CVE-2026-109597MEDIUMHugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsEPSS 0.2%CVE-2024-58322MEDIUMKentico Xperience <= 13.0.158 Shipping Options Stored XSSEPSS 0.2%CVE-2025-67734MEDIUMFrappe Authenticated Users can Execute JavaScript through its Job FormEPSS 0.2%CVE-2026-84925MEDIUMAvada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterEPSS 0.2%CVE-2025-2154MEDIUMStored XSS in EchoCCS's Specto CMEPSS 0.2%CVE-2025-64999HIGHCross-site scripting in HTML logs of Synthetic Monitoring test servicesEPSS 0.2%CVE-2026-94154MEDIUMAurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' ParameterEPSS 0.2%CVE-2026-2951MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTMLEPSS 0.2%CVE-2026-106707MEDIUMXXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated useEPSS 0.2%CVE-2026-39380MEDIUMOpen Source Point of Sale has Stored XSS in Stock Location (Configuration)EPSS 0.2%CVE-2026-12054MEDIUMDownload Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' ParameterEPSS 0.2%CVE-2026-89117MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2026-40451MEDIUMDeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to eEPSS 0.2%CVE-2026-124452MEDIUMOpenEMR before 8.3.0 Stored XSS via Eye Exam Document NotesEPSS 0.2%CVE-2026-106706MEDIUMXXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores tEPSS 0.2%CVE-2026-20108MEDIUMA vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to condEPSS 0.2%CVE-2026-6417MEDIUMGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'EPSS 0.2%