Falhas do tipo CWE-79

29.656 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2024-30953MEDIUMA stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.4%CVE-2024-12593MEDIUMPDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab ShortcodeEPSS 0.4%CVE-2025-22547HIGHWordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2025-22338HIGHWordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-47665HIGHWordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-33539MEDIUMWordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-103904HIGHStored XSS Vulnerability in JTL-ShopEPSS 0.4%CVE-2024-2925MEDIUMBeaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.4%CVE-2025-22548HIGHWordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2025-4054MEDIUMRelevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search HighlightsEPSS 0.4%CVE-2024-1357MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' ShortcodeEPSS 0.4%CVE-2023-5891MEDIUMCross-site Scripting (XSS) - Reflected in pkp/pkp-libEPSS 0.4%CVE-2023-5048MEDIUMWDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-7377HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2026-19760HIGHWP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host HeaderEPSS 0.4%CVE-2023-6747MEDIUMFooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-13141MEDIUMosuuu LightPicture SVG File Upload upload cross site scriptingEPSS 0.4%CVE-2024-0691MEDIUMFileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder ImportEPSS 0.4%CVE-2024-27680MEDIUMFlusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form."EPSS 0.4%