Falhas do tipo CWE-79

29.789 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-56144MEDIUMStored XSS-LibreNMS-Display Name 2 in librenmsEPSS 0.4%CVE-2024-9613MEDIUMFormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-46089MEDIUMCross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to executeEPSS 0.4%CVE-2022-46088MEDIUMOnline Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form.EPSS 0.4%CVE-2024-8871MEDIUMPricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9222MEDIUMPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-47829MEDIUMWordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-54117CRITICALNamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editorEPSS 0.4%CVE-2025-63892MEDIUMA vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function create_classroom of the fileEPSS 0.4%CVE-2024-28823MEDIUMAmazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.EPSS 0.4%CVE-2024-8800MEDIUMRabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more <= 2.21.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-51026MEDIUMThe NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is poEPSS 0.4%CVE-2023-48329MEDIUMWordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2025-47943MEDIUMGogs stored XSS in PDF rendererEPSS 0.4%CVE-2025-14046HIGHInsufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsEPSS 0.4%CVE-2023-23815MEDIUMWordPress Multi-column Tag Map Plugin <= 17.0.24 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-2047MEDIUMPHPGurukul Art Gallery Management System search.php cross site scriptingEPSS 0.4%CVE-2024-3615MEDIUMMedia Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'EPSS 0.4%CVE-2024-24558HIGHreact-query-streamed-hydration xssEPSS 0.4%