Falhas do tipo CWE-79

29.799 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-47229MEDIUMWordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-2337HIGHRefleccted XSS on Plunet BusinessManagerEPSS 0.4%CVE-2023-4779MEDIUMUser Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-4745MEDIUMcode-projects Employee Record System current_employees.php cross site scriptingEPSS 0.4%CVE-2023-23707MEDIUMWordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-45712LOWSolarWinds Serv-U Client-Side Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2022-45817MEDIUMWordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-43938HIGHYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderEPSS 0.4%CVE-2023-26954MEDIUMonekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.EPSS 0.4%CVE-2022-40699MEDIUMWordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-42474MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web IntelligenceEPSS 0.4%CVE-2024-24812MEDIUMFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesEPSS 0.4%CVE-2023-49828MEDIUMWordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-11707CRITICALMultiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application ManagerEPSS 0.4%CVE-2024-6588MEDIUMPowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url ParameterEPSS 0.4%CVE-2024-45513MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/EPSS 0.4%CVE-2023-31860MEDIUMWuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.EPSS 0.4%CVE-2026-11712CRITICALIBM WebSphere Application Server is affected by a cross-site scripting vulnerabilityEPSS 0.4%CVE-2025-41425HIGHDuraComm DP-10iN-100-MU Cross-site ScriptingEPSS 0.4%CVE-2026-39335MEDIUMChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsEPSS 0.4%