Falhas do tipo CWE-79

30.643 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-47900MEDIUMStored XSS via Unsanitized Plugin Metadata in LogseqEPSS 0.1%CVE-2026-115610MEDIUMWordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-93464MEDIUMA stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitEPSS 0.1%CVE-2026-118492LOWIn Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in tEPSS 0.1%CVE-2025-70365MEDIUMA stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in adminEPSS 0.1%CVE-2026-8981LOWLazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTMLEPSS 0.1%CVE-2026-11569MEDIUMQuay: quay: stored xss via filedrop svg uploadEPSS 0.1%CVE-2026-9060LOWAgile Store Locator < 1.6.6 - Admin+ Stored XSS via map_styleEPSS 0.1%CVE-2026-36766MEDIUMMultiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackEPSS 0.1%CVE-2026-6370MEDIUMWordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-116148MEDIUMImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing OptionsEPSS 0.1%CVE-2026-23695MEDIUMCockpit CMS 2.14.0 Stored XSS via Set Field Display TemplateEPSS 0.1%CVE-2026-116900MEDIUMREDAXO before 5.21.4 Stored XSS via Media and Link Input WidgetsEPSS 0.1%CVE-2026-0266LOWPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceEPSS 0.1%CVE-2026-112333MEDIUMGFI Archiver < 15.14 Stored XSS via MailInsights.aspxEPSS 0.1%CVE-2026-116202MEDIUMYesWiki before 4.7.0 Stored XSS via ImageField SVG UploadEPSS 0.1%CVE-2026-76976MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)EPSS 0.1%CVE-2026-56007MEDIUMWordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-31313MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execEPSS 0.1%CVE-2025-70842MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenEPSS 0.1%