Falhas do tipo CWE-79

29.786 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2023-49180MEDIUMWordPress Automatic Youtube Video Posts Plugin Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9357MEDIUMxili-tidy-tags <= 1.12.04 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-54117CRITICALNamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editorEPSS 0.4%CVE-2024-9384MEDIUMQuantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-52059MEDIUMA cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaEPSS 0.4%CVE-2022-46089MEDIUMCross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to executeEPSS 0.4%CVE-2024-13504HIGHShared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.4%CVE-2021-24618—Donate With QRCode < 1.4.5 - Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-49190MEDIUMWordPress Site Offline Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-56144MEDIUMStored XSS-LibreNMS-Display Name 2 in librenmsEPSS 0.4%CVE-2024-5638MEDIUMFormula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_pluginsEPSS 0.4%CVE-2023-28423MEDIUMWordPress Modern Footnotes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-48329MEDIUMWordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-3995MEDIUMOPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' SettingEPSS 0.4%CVE-2024-6367MEDIUMLabVantage LIMS POST Request cross site scriptingEPSS 0.4%CVE-2025-51864MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hEPSS 0.4%CVE-2025-63892MEDIUMA vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function create_classroom of the fileEPSS 0.4%CVE-2023-23885MEDIUMWordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39921MEDIUMWordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%