Falhas do tipo CWE-79

29.653 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-2159MEDIUMSourceCodester Simple Responsive Tourism Website Registration Master.php cross site scriptingEPSS 0.4%CVE-2026-73524MEDIUMCypht < 2.12.2 XSS via FROM Email Header in Contacts ModuleEPSS 0.4%CVE-2025-1579MEDIUMcode-projects Blood Bank System user.php cross site scriptingEPSS 0.4%CVE-2024-7427MEDIUMPotential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi).EPSS 0.4%CVE-2024-42055MEDIUMCervantes through 0.5-alpha allows stored XSS.EPSS 0.4%CVE-2024-56376MEDIUMA stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious EPSS 0.4%CVE-2025-34512MEDIUMIlevia EVE X1 Server 4.7.18.0.eden Reflected XSSEPSS 0.4%CVE-2024-51494MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phpEPSS 0.4%CVE-2024-7082MEDIUMeasy-table-of-contents < 2.0.68 - Editor+ Stored XSSEPSS 0.4%CVE-2026-29964MEDIUMHSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization oEPSS 0.4%CVE-2024-31649MEDIUMA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.4%CVE-2023-25466MEDIUMWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11895MEDIUMOnline Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-47607MEDIUMWordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-15093MEDIUMsunkaifei FlyCMS Admin Login IndexAdminController.java cross site scriptingEPSS 0.4%CVE-2024-51495MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.phpEPSS 0.4%CVE-2026-2150MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scriptingEPSS 0.4%CVE-2023-36384HIGHWordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-4085MEDIUMTabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-22704HIGHWordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%