Falhas do tipo CWE-79

29.617 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-9898MEDIUMParallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax ShortcodeEPSS 0.4%CVE-2023-31806MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.4%CVE-2024-9206MEDIUMMAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9350MEDIUMDPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-22624MEDIUMFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS)EPSS 0.4%CVE-2026-45115HIGHMyBB: Buddy/ignore list username XSSEPSS 0.4%CVE-2026-75933HIGHJet Admin Stored XSSEPSS 0.4%CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2026-95657MEDIUMdgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scriptingEPSS 0.4%CVE-2023-35882MEDIUMWordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12089HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.4%CVE-2023-47813MEDIUMWordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-37679MEDIUMCross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker tEPSS 0.4%CVE-2023-44390MEDIUMHtmlSanitizer vulnerable to Cross-site Scripting in Foreign ContentEPSS 0.4%CVE-2026-25529HIGHPostal has HTML injection / XSS in message viewEPSS 0.4%CVE-2022-41432MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/reEPSS 0.4%CVE-2024-7134HIGHLiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data ParameterEPSS 0.4%CVE-2024-9024MEDIUMMaterial Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon ShortcodeEPSS 0.4%CVE-2020-3420MEDIUMCisco Unified Communications Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.4%