Falhas do tipo CWE-79

29.693 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-14151HIGHSlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4363MEDIUMVisual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag ParameterEPSS 0.4%CVE-2023-25810MEDIUMPersistent Cross site scripting (XSS) through description in status page in Uptime KumaEPSS 0.4%CVE-2023-25459MEDIUMWordPress Post Snippets Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27618MEDIUMWordPress Store Locator WordPress Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32575MEDIUMWordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-4551MEDIUMContiNew Admin file cross site scriptingEPSS 0.4%CVE-2023-36678MEDIUMWordPress WP Content Copy Protection & No Right Click Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-40490MEDIUMTiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackersEPSS 0.4%CVE-2026-54395MEDIUMMISP UiBeta event index reflected XSS in advanced filter popupEPSS 0.4%CVE-2023-25456MEDIUMWordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-36382MEDIUMWordPress Media Library Categories Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2021-46677MEDIUMVulnerability XSS in Event filter name fieldEPSS 0.4%CVE-2026-86507MEDIUMApache Roller: Stored XSS in comment moderation via comment author URLEPSS 0.4%CVE-2022-46852MEDIUMWordPress WP Table Builder – WordPress Table Plugin Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-3826MEDIUMSourceCodester Web-based Pharmacy Product Management System add-supplier.php cross site scriptingEPSS 0.4%CVE-2023-5615MEDIUMSkype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2022-38390MEDIUMMultiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrarEPSS 0.4%CVE-2023-37874MEDIUMWordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-73161MEDIUMcti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search HighlightingEPSS 0.4%