Falhas do tipo CWE-79

29.626 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-47544HIGHWordPress Atarim Plugin <= 3.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49740HIGHWordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-26930HIGHSmarterTools SmarterMail before 9526 allows XSS via MAPI requests.EPSS 0.4%CVE-2021-24349—Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-73319MEDIUMXenForo < 2.3.13 XSS via Dynamic Redirect HandlerEPSS 0.4%CVE-2026-3551MEDIUMCustom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' SettingEPSS 0.4%CVE-2026-3367MEDIUMLockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' SettingEPSS 0.4%CVE-2021-24543—jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-48771HIGHWordPress File Gallery Plugin <= 1.8.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47848HIGHWordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47673HIGHWordPress Post Pay Counter Plugin <= 2.784 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49172HIGHWordPress BrainCert – HTML5 Virtual Classroom Plugin <= 1.30 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54387HIGHWordPress Posts Date Ranges plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-38694LOWUmbraco CMS vulnerable to possible injection of HTML in an unintended formEPSS 0.4%CVE-2024-54403HIGHWordPress Visual Recent Posts plugin <= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%CVE-2024-25218MEDIUMA cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 0.4%CVE-2025-11283MEDIUMFrappe LMS Course cross site scriptingEPSS 0.4%CVE-2025-60503HIGHA cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted iEPSS 0.4%CVE-2024-2597HIGHCross-Site Scripting (XSS) in AMSS++EPSS 0.4%CVE-2025-53923HIGHEmlog vulnerable to reflected Cross-site Scripting in admin panelEPSS 0.4%