Falhas do tipo CWE-79

29.621 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-12437MEDIUMMarketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.4%CVE-2024-2523LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php cross site scriptingEPSS 0.4%CVE-2024-39162MEDIUMpyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainerEPSS 0.4%CVE-2024-11829MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-41239MEDIUMDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeEPSS 0.4%CVE-2024-10785MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2065LOWSourceCodester Barangay Population Monitoring System update-resident.php cross site scriptingEPSS 0.4%CVE-2024-13202MEDIUMwander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scriptingEPSS 0.4%CVE-2023-25040MEDIUMWordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-31081HIGHWordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-40290MEDIUMReflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.4%CVE-2026-8152CRITICALUnblu Spark Open Redirect leading to DOM-Based XSSEPSS 0.4%CVE-2023-29636MEDIUMCross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fielEPSS 0.4%CVE-2018-25097LOWAcumos Design Studio cross site scriptingEPSS 0.4%CVE-2024-10197MEDIUMcode-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scriptingEPSS 0.4%CVE-2020-19660MEDIUMCross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values.EPSS 0.4%CVE-2023-50947MEDIUMIBM Business Automation Workflow cross-site scriptingEPSS 0.4%CVE-2024-11116MEDIUMInappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in spEPSS 0.4%CVE-2023-30489HIGHWordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%