Falhas do tipo CWE-79

29.626 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-41237HIGHWordPress Arya Multipurpose Pro Theme <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8681MEDIUMPremium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid WidgetEPSS 0.4%CVE-2022-41258MEDIUMDue to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious scripEPSS 0.4%CVE-2024-2596HIGHCross-Site Scripting (XSS) in AMSS++EPSS 0.4%CVE-2026-65937HIGHWhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UIEPSS 0.4%CVE-2025-24428MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-27502MEDIUMSVXportal <= 2.5 log.php Search Reflected XSSEPSS 0.4%CVE-2025-50056MEDIUMExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for JoomlaEPSS 0.4%CVE-2025-23602HIGHWordPress EELV Newsletter plugin <= 4.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23760HIGHWordPress Chatter plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2024-33253MEDIUMCross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged aEPSS 0.4%CVE-2026-47185MEDIUMFrappe Has Broken Access Control in its Workspace Save APIEPSS 0.4%CVE-2025-24570HIGHWordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56313MEDIUMA stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject maliEPSS 0.4%CVE-2022-48115MEDIUMThe dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).EPSS 0.4%CVE-2024-23181MEDIUMCross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29EPSS 0.4%CVE-2023-6609LOWosCommerce all-products cross site scriptingEPSS 0.4%CVE-2023-41238HIGHWordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41861HIGHWordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54395HIGHWordPress Increase Sociability plugin <= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%