Falhas do tipo CWE-79

29.799 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-36211MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-31445HIGHWordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49846MEDIUMWordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7304MEDIUMNinja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-49820MEDIUMWordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7302MEDIUMBlog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.4%CVE-2024-11110MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a EPSS 0.4%CVE-2024-6804MEDIUMJeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG FileEPSS 0.4%CVE-2024-36186MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-36208MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-47834MEDIUMWordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47850MEDIUMWordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-6208MEDIUMDownload Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-47231MEDIUMWordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30554HIGHWordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31078HIGHWordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32503HIGHWordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30778HIGHWordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-67855MEDIUMMooodle: mooodle: information disclosure and script execution via reflected cross-site scriptingEPSS 0.4%CVE-2024-5763MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%