Falhas do tipo CWE-79

29.751 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-23981MEDIUMWordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-46970LOWIn JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possibleEPSS 0.4%CVE-2023-23972MEDIUMWordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24002MEDIUMWordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-10108HIGHWPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add ShortcodeEPSS 0.4%CVE-2022-37402MEDIUMWordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-43874MEDIUMIBM App Connect Enterprise Certified ContainerEPSS 0.4%CVE-2022-44742MEDIUMWordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23998MEDIUMWordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37523MEDIUMHCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tagsEPSS 0.4%CVE-2024-11459MEDIUMCountry Blocker <= 3.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-23675MEDIUMWordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8917MEDIUMAnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-34377MEDIUMWordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.4%CVE-2026-6820HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email FieldEPSS 0.4%CVE-2023-23674MEDIUMWordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24381MEDIUMWordPress Advanced Social Pixel Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44582MEDIUMWordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23971MEDIUMWordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%