Falhas do tipo CWE-79

30.643 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-39692MEDIUMWordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108495MEDIUMWordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-34887MEDIUMWordPress Kubio AI Page Builder plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-39708MEDIUMWordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-39702MEDIUMWordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-5191MEDIUMTiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'EPSS 0.1%CVE-2024-11023MEDIUMSession Hijacking in Firebase JavaScript SDKEPSS 0.1%CVE-2025-62043MEDIUMWordPress WPCasa plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-24662MEDIUMCross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file contEPSS 0.1%CVE-2026-41421HIGHSiYuan Desktop Notification XSS Leads to Electron RCEEPSS 0.1%CVE-2026-50591MEDIUMIn Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.EPSS 0.1%CVE-2026-16020MEDIUMStored XSS Fazile BACAK's DefterAsist Financial Advisor PlatformEPSS 0.1%CVE-2026-106143MEDIUMCross-Site Scripting in Progress Software Kendo UI for VueEPSS 0.1%CVE-2026-36388MEDIUMA Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php pagEPSS 0.1%CVE-2026-12463MEDIUMInappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the reEPSS 0.1%CVE-2026-92085MEDIUMStored XSS in TMT Machine's Talassoft Industrial Management SoftwareEPSS 0.1%CVE-2026-111414MEDIUMWordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-112199MEDIUMWordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42676MEDIUMWordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-121768MEDIUMWordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%