Falhas do tipo CWE-79

29.607 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-12976MEDIUMEvents Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' ShortcodeEPSS 0.4%CVE-2023-35918HIGHWordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25427MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispywareEPSS 0.4%CVE-2024-25875MEDIUMA cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HEPSS 0.4%CVE-2025-59840HIGHVega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variableEPSS 0.4%CVE-2024-7914MEDIUMSourceCodester Yoga Class Registration System SystemSettings.php cross site scriptingEPSS 0.4%CVE-2022-41788MEDIUMWordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2019-25417MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS RulesEPSS 0.4%CVE-2023-51306MEDIUMPHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters.EPSS 0.4%CVE-2023-51325MEDIUMPHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.EPSS 0.4%CVE-2023-4592MEDIUMImproper Neutralization of Input During Web Page Generation in WPN-XM ServerstackEPSS 0.4%CVE-2024-1822LOWPHPGurukul Tourism Management System user-bookings.php cross site scriptingEPSS 0.4%CVE-2023-47623MEDIUMScrypted reflected Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2024-3674MEDIUMInline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-25207MEDIUMBarangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident functionEPSS 0.4%CVE-2024-3338MEDIUMColibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-23173MEDIUMAn issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. TEPSS 0.4%CVE-2024-23177MEDIUMAn issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameEPSS 0.4%CVE-2024-41673HIGHDecidim has a cross-site scripting vulnerability in the version control pageEPSS 0.4%CVE-2024-24062MEDIUMspringboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.EPSS 0.4%