Falhas do tipo CWE-79

29.506 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-46516MEDIUMFrogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)EPSS 0.4%CVE-2023-28664MEDIUMThe Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in EPSS 0.4%CVE-2024-4624MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4652LOWCampcodes Complete Web-Based School Management System show_teacher2.php cross site scriptingEPSS 0.4%CVE-2026-18323HIGHForminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)EPSS 0.4%CVE-2026-11942MEDIUMAkaunting 3.1.21 - Stored XSS in delete confirmation modalEPSS 0.4%CVE-2023-28666MEDIUMThe InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' paraEPSS 0.4%CVE-2022-4959LOWqkmc-rk redbbs Nickname cross site scriptingEPSS 0.4%CVE-2025-25203HIGHCtrlpanel has stored XSS vulnerability in TicketsController priority fieldEPSS 0.4%CVE-2023-47816MEDIUMWordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-5338MEDIUMTheme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2021-4046MEDIUMTCMAN GIM Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-23820MEDIUMWordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23830HIGHWordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-65754MEDIUMCross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filEPSS 0.4%CVE-2026-27614CRITICALBugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace renderingEPSS 0.4%CVE-2024-29034MEDIUMCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedEPSS 0.4%CVE-2026-24769HIGHNocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadEPSS 0.4%CVE-2024-42762MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows EPSS 0.4%CVE-2023-5861MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.4%