Falhas do tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-22902MEDIUMOpenfind Mail2000 - XSSEPSS 0.4%CVE-2024-4487MEDIUMBlocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.4%CVE-2023-1181MEDIUMCross-site Scripting (XSS) - Stored in icret/easyimages2.0EPSS 0.4%CVE-2023-25018MEDIUMRifartek IOT Wall - Reflected XSSEPSS 0.4%CVE-2024-4383MEDIUMSimple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-86188MEDIUMAVideo YPTSocket Plugin Unauthenticated Cross-Site ScriptingEPSS 0.4%CVE-2024-4209MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown TimerEPSS 0.4%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.4%CVE-2025-7959MEDIUMStation Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height ParametersEPSS 0.4%CVE-2025-49898HIGHWordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-26847MEDIUMA stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a craftedEPSS 0.4%CVE-2024-23179MEDIUMAn issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based EPSS 0.4%CVE-2025-40697MEDIUMReflected Cross-Site Scripting (XSS) in Lewe WebMeasureEPSS 0.4%CVE-2024-26466MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before coEPSS 0.4%CVE-2022-44031MEDIUMRedmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syEPSS 0.4%CVE-2024-11259MEDIUMcode-projects Farmacia fornecedores.php cross site scriptingEPSS 0.4%CVE-2025-7966MEDIUMGet Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att FunctionEPSS 0.4%CVE-2024-2504MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributesEPSS 0.4%CVE-2023-29641MEDIUMCross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted EPSS 0.4%CVE-2026-52798HIGHGogs: Stored XSS in `.ipynb` PreviewEPSS 0.4%