Falhas do tipo CWE-79

29.627 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-41235HIGHWordPress Everest News Pro Theme <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51093HIGHStored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScripEPSS 0.4%CVE-2024-56314MEDIUMA stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject maliciouEPSS 0.4%CVE-2024-30880MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.4%CVE-2024-25225MEDIUMA cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2023-35884HIGHWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-22639MEDIUMiGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing iEPSS 0.4%CVE-2023-27629MEDIUMWordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-0397MEDIUMreckcn SPPanAdmin edit cross site scriptingEPSS 0.4%CVE-2024-50522HIGHWordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-28091MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 0.4%CVE-2025-9923MEDIUMCampcodes Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2024-51497MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.phpEPSS 0.4%CVE-2024-4615MEDIUMElespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu WidgetEPSS 0.4%CVE-2026-80426HIGHFiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field DescriptionEPSS 0.4%CVE-2024-11788MEDIUMStreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-33866MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.EPSS 0.4%CVE-2024-45153MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2022-45065HIGHWordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.20 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-5125MEDIUMContact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%