Falhas do tipo CWE-79

29.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-51790MEDIUMCross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in theEPSS 0.5%CVE-2026-76983MEDIUMApache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabelEPSS 0.5%CVE-2024-34091HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%CVE-2026-76789HIGHSlider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider HandlersEPSS 0.5%CVE-2026-87786HIGHDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesEPSS 0.5%CVE-2026-11767HIGHCRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact FormEPSS 0.5%CVE-2026-10081HIGHUnlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews WidgetEPSS 0.5%CVE-2026-88793HIGHYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverEPSS 0.5%CVE-2026-81660HIGHGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio FieldEPSS 0.5%CVE-2023-5791LOWSourceCodester Sticky Notes App add-note.php cross site scriptingEPSS 0.5%CVE-2023-5698LOWCodeAstro Internet Banking System pages_deposit_money.php cross site scriptingEPSS 0.5%CVE-2023-5930LOWCampcodes Simple Student Information System manage_academic.php cross site scriptingEPSS 0.5%CVE-2026-76985MEDIUMApache Wicket: XSS in Palette via getAdditionalAttributesEPSS 0.5%CVE-2026-4300MEDIUMRobo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' SettingEPSS 0.5%CVE-2026-12968HIGHProduct Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG UploadEPSS 0.5%CVE-2023-5697LOWCodeAstro Internet Banking System pages_withdraw_money.php cross site scriptingEPSS 0.5%CVE-2024-1989MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-26313HIGHArcher Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicEPSS 0.5%CVE-2026-88824HIGHMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label SettingsEPSS 0.5%CVE-2026-78333HIGH12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event LogEPSS 0.5%