Falhas do tipo CWE-79

29.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-3320MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.4%CVE-2024-54358HIGHWordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8541MEDIUMDiscount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-44205MEDIUMFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image UploadEPSS 0.4%CVE-2026-65763MEDIUMJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4EPSS 0.4%CVE-2026-55081HIGHDHIS2 Reflected XSS in OpenAPI HTML scope parameterEPSS 0.4%CVE-2026-40282MEDIUMWeGIA has stored XSS in intercorrencia_visualizar.phpEPSS 0.4%CVE-2023-4962MEDIUMVideo PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-54275HIGHWordPress CSV to html plugin <= 3.08 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-29420MEDIUMWordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-29052MEDIUMUsers were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. AttackEPSS 0.4%CVE-2026-47739MEDIUMFrappe: Stored XSS in NoteEPSS 0.4%CVE-2026-53758HIGHEmlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not SanitizedEPSS 0.4%CVE-2026-78073MEDIUMJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0EPSS 0.4%CVE-2026-5010MEDIUMReflected Cross-Site Scripting (XSS) in Sanoma’s ClickeduEPSS 0.4%CVE-2024-23887HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-4747HIGHWordPress Propovoice CRM plugin <= 1.7.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12000MEDIUMcode-projects Blood Bank System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2024-54305HIGHWordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54235HIGHWordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%