Falhas do tipo CWE-79

29.593 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-85678MEDIUMAI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScriptEPSS 0.4%CVE-2026-86788MEDIUMHT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%CVE-2026-15253MEDIUMEasy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment TitleEPSS 0.4%CVE-2026-84899MEDIUMVikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffixEPSS 0.4%CVE-2026-83544MEDIUMGreenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps AttributeEPSS 0.4%CVE-2026-16559MEDIUMYMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon UploadEPSS 0.4%CVE-2022-42071MEDIUMOnline Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability.EPSS 0.4%CVE-2026-91011MEDIUMEWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference ExpansionEPSS 0.4%CVE-2024-24904HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network EPSS 0.4%CVE-2026-14318MEDIUMGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsEPSS 0.4%CVE-2026-19697MEDIUMGutenKit < 2.5.0 - Author+ Stored XSS via SVG UploadEPSS 0.4%CVE-2024-51858MEDIUMWordPress Social Locker plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49987MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execuEPSS 0.4%CVE-2024-2801MEDIUMShopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-84369MEDIUMSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsEPSS 0.4%CVE-2025-29152HIGHCross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple compEPSS 0.4%CVE-2026-90943CRITICALparallax filament-comments through 3.0.0 Stored XSS via Comment BodyEPSS 0.4%CVE-2023-6934MEDIUMLimit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-56882MEDIUMSage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permaneEPSS 0.4%