Falhas do tipo CWE-79

29.693 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-6841MEDIUMReflected XSS in Request TrackerEPSS 0.4%CVE-2024-22288HIGHWordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-91127HIGHFile Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererEPSS 0.4%CVE-2024-10879MEDIUMForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-44851MEDIUMA stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web sEPSS 0.4%CVE-2019-25411MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCPEPSS 0.4%CVE-2022-45179MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todEPSS 0.4%CVE-2023-44229MEDIUMWordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45607MEDIUMWordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29923HIGHWordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-91165LOWWarpgate: Markup injection in SSO form_post return page via unencoded redirect/error valuesEPSS 0.4%CVE-2023-40677MEDIUMWordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.4%CVE-2024-32149HIGHWordPress Jobs for WordPress plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29915HIGHWordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-56672HIGHComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type SanitizationEPSS 0.4%CVE-2020-37087MEDIUMEasy Transfer 1.7 for iOS - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2023-24514MEDIUMStored Cross Site Scripting Vulnerability in Visual Console ModuleEPSS 0.4%CVE-2019-25418MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via fwgroupsEPSS 0.4%CVE-2024-27952HIGHWordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%