Falhas do tipo CWE-79

29.714 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-30267MEDIUMCLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.EPSS 0.4%CVE-2025-10065MEDIUMitsourcecode POS Point of Sale System dom_data_th.php cross site scriptingEPSS 0.4%CVE-2026-54386MEDIUMmarimo < 0.23.9 XSS via file Query Parameter in assets.pyEPSS 0.4%CVE-2025-20179MEDIUMCisco Expressway Series Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-25064MEDIUMWordPress WP htpasswd Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-2825MEDIUMrachelos WeRSS we-mp-rss Article fix.py fix_html cross site scriptingEPSS 0.4%CVE-2026-34567CRITICALCI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2024-32574HIGHWordPress WP Simple HTML Sitemap plugin <= 2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49189MEDIUMWordPress Social Share Buttons & Analytics Plugin – GetSocial.io Plugin <= 4.3.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25022MEDIUMWordPress Watu Quiz Plugin <= 3.3.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-24061MEDIUMspringboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.EPSS 0.4%CVE-2026-34565CRITICALCI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2023-4887MEDIUMGoogle Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-32559HIGHWordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-25028MEDIUMWordPress CC Custom Taxonomy Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49770MEDIUMWordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-52277MEDIUMCross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta coEPSS 0.4%CVE-2023-1298MEDIUMServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the SeEPSS 0.4%CVE-2024-32595HIGHWordPress WP Helper Premium plugin < 4.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1105MEDIUMSiberianCMS HTTP GET Request flat cross site scriptingEPSS 0.4%