Falhas do tipo CWE-79

29.079 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-33942MEDIUMCross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and LiferaEPSS 0.5%CVE-2021-32859MEDIUMBaremetrics date range picker vulnerable to Cross-site ScriptingEPSS 0.5%CVE-2025-8349MEDIUMCross-Site Scripting (XSS) stored in Tawk Live ChatEPSS 0.5%CVE-2022-32407MEDIUMSoftr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account EPSS 0.5%CVE-2024-1541MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-53864MEDIUMCross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-uiEPSS 0.5%CVE-2023-5864HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-1497MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attributeEPSS 0.5%CVE-2021-23225—Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field EPSS 0.5%CVE-2024-0700MEDIUMSimple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-46367CRITICALA Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by EPSS 0.5%CVE-2024-1074MEDIUMBeaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio WidgetEPSS 0.5%CVE-2025-1517MEDIUMSina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form ShortcodesEPSS 0.5%CVE-2024-7900MEDIUMxiaohe4966 TpMeCMS Basic Configuration config cross site scriptingEPSS 0.5%CVE-2023-1757HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-1148MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2024-1499MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-3387MEDIUMLana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-47093HIGHFix various XSS issues and potential RCEEPSS 0.5%CVE-2022-37330MEDIUMWordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%