Falhas do tipo CWE-79

29.772 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-47421MEDIUMWordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24522MEDIUMDue to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenEPSS 0.4%CVE-2025-23695HIGHWordPress CtyGrid Hyp3rL0cal Search plugin <= 0.1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-3543LOWGZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scriptingEPSS 0.4%CVE-2024-11894MEDIUMThe Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-29471MEDIUMOneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.EPSS 0.4%CVE-2024-11278MEDIUMGD bbPress Attachments <= 4.7.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-51299MEDIUMPHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugiEPSS 0.4%CVE-2023-51300MEDIUMPHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_smEPSS 0.4%CVE-2024-8189MEDIUMWP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9060MEDIUMAVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-35097HIGHWordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41871HIGHWordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-38138HIGHBIG-IP Configuration utility vulnerabilityEPSS 0.4%CVE-2024-4709MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-29099MEDIUMWordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-3821MEDIUMSourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scriptingEPSS 0.4%CVE-2023-35098HIGHWordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27378HIGHBIG-IP TMUI XSS vulnerabilityEPSS 0.4%CVE-2023-40330HIGHWordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%