Falhas do tipo CWE-79

30.630 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-27068HIGHWordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25368MEDIUMOPNsense 19.1 Reflected XSS via diag_backup.phpEPSS 0.2%CVE-2026-27070HIGHWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-17739MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-33404LOWPi-hole has a Stored XSS / HTML injection in the Network page/DashboardEPSS 0.1%CVE-2026-84463MEDIUMZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributeEPSS 0.1%CVE-2026-107308LOWCountry - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211EPSS 0.1%CVE-2026-33276HIGHXSS in Unified Search via Unescaped Host/Service NamesEPSS 0.1%CVE-2026-59188MEDIUMPart-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ViewerEPSS 0.1%CVE-2026-115554MEDIUMTivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scriptingEPSS 0.1%CVE-2026-8139LOWConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvNameEPSS 0.1%CVE-2026-45560MEDIUMRoxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)EPSS 0.1%CVE-2026-101111MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6EPSS 0.1%CVE-2026-48905MEDIUMJoomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.EPSS 0.1%CVE-2026-12425MEDIUMReflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10EPSS 0.1%CVE-2026-17189HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-35212MEDIUMOpenCTI has XSS in the rendering of email-message observable body dataEPSS 0.1%CVE-2026-38669MEDIUMwCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.EPSS 0.1%CVE-2026-49294MEDIUMValhalla has reflected XSS via unsanitized JSONP callback parameterEPSS 0.1%CVE-2026-101109MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8EPSS 0.1%