Falhas do tipo CWE-79

30.604 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-62758MEDIUMWordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-91829HIGHSubscribe to Comments < 2.3.3 - Reflected XSS via 'ref' ParameterEPSS 0.2%CVE-2026-29828MEDIUMDooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.EPSS 0.2%CVE-2026-7814MEDIUMpgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerEPSS 0.2%CVE-2026-101890MEDIUMPrime Mover < 2.2.1 Stored XSS via Package MetadataEPSS 0.2%CVE-2026-2837MEDIUMRicerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's SettingsEPSS 0.2%CVE-2026-47694MEDIUMWWBN AVideo: Stored XSS via unescaped Gallery category descriptionEPSS 0.2%CVE-2026-31879MEDIUMFrappe Workspace modification and stored XSS due to improper resource ownership checksEPSS 0.2%CVE-2026-32095MEDIUMPlunk has Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.2%CVE-2025-27895MEDIUMDB2 Recovery Expert for Linux, UNIX and Windows Cross-Site ScriptingEPSS 0.2%CVE-2026-55422MEDIUMconda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboardEPSS 0.2%CVE-2026-2687MEDIUMReading progressbar < 1.3.1 - Admin+ Stored XSSEPSS 0.2%CVE-2026-39508MEDIUMWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36750HIGHStored cross site scripting (XSS) vulnerability in Growatt ShineLan-XEPSS 0.2%CVE-2026-31914MEDIUMWordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27896MEDIUMIBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site ScriptingEPSS 0.2%CVE-2026-39483MEDIUMWordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66843MEDIUMgrav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-pEPSS 0.2%CVE-2026-25355MEDIUMWordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-36728MEDIUMA markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execuEPSS 0.2%