Falhas do tipo CWE-79

29.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-63264MEDIUMJoomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3EPSS 0.4%CVE-2026-76564HIGHJoomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7EPSS 0.4%CVE-2026-78391HIGHStored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLookEPSS 0.4%CVE-2026-57833HIGHJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2EPSS 0.4%CVE-2024-34431HIGHWordPress WP etracker plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54406HIGHWordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-75531HIGHStored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in PandoraEPSS 0.4%CVE-2020-7303MEDIUMDLP ePO extension - Cross-site scriptingEPSS 0.4%CVE-2023-4479HIGHStored XSS Vulnerability in M-Files WebEPSS 0.4%CVE-2024-54274HIGHWordPress Octrace Support plugin <= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-77027HIGHJoomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2EPSS 0.4%CVE-2026-76569MEDIUMJoomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4EPSS 0.4%CVE-2024-6011MEDIUMCost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12183MEDIUMDedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scriptingEPSS 0.4%CVE-2024-54231HIGHWordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-78302HIGHJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4EPSS 0.4%CVE-2024-23725MEDIUMGhost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.EPSS 0.4%CVE-2023-51335MEDIUMPHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.EPSS 0.4%CVE-2024-7100MEDIUMBold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button ShortcodeEPSS 0.4%CVE-2026-95661MEDIUMMISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type ListEPSS 0.4%