Falhas do tipo CWE-79

29.621 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-58643MEDIUMWindows Admin Center Spoofing VulnerabilityEPSS 0.4%CVE-2024-5083MEDIUMNexus Repository 2 - Stored XSSEPSS 0.4%CVE-2024-3558MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]EPSS 0.4%CVE-2025-56526MEDIUMCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.EPSS 0.4%CVE-2024-9239MEDIUMBooster for WooCommerce <= 7.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12182MEDIUMDedeCMS soft_add.php cross site scriptingEPSS 0.4%CVE-2019-25419MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via scheduleEPSS 0.4%CVE-2026-92136HIGHJenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultinEPSS 0.4%CVE-2026-92134HIGHJenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitteEPSS 0.4%CVE-2025-8668CRITICALReflected XSS in E-Kalite Software Hardware Engineering's TurboardEPSS 0.4%CVE-2023-49485MEDIUMJFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.EPSS 0.4%CVE-2026-92135HIGHJenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thrEPSS 0.4%CVE-2024-27757MEDIUMflusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development asEPSS 0.4%CVE-2026-56698MEDIUMNuxt - Cross-Site Scripting via navigateTo open OptionEPSS 0.4%CVE-2021-39161MEDIUMCross-site scripting via category name in DiscourseEPSS 0.4%CVE-2026-4811MEDIUMWPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category FieldEPSS 0.4%CVE-2026-36748CRITICALRockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.EPSS 0.4%CVE-2024-12181MEDIUMDedeCMS SWF File uploads_add.php cross site scriptingEPSS 0.4%CVE-2023-6556MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-45500MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.4%