Falhas do tipo CWE-79

29.810 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-30754HIGHWordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39164HIGHWordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-4860MEDIUMThe 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lacEPSS 0.4%CVE-2023-24392HIGHWordPress Full Width Banner Slider Wp Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-4474MEDIUMitsourcecode University Management System admin_single_student_update.php cross site scriptingEPSS 0.4%CVE-2023-41663HIGHWordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49174MEDIUMWordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37893HIGHWordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-29385HIGHWordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-55958MEDIUMNorthern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.EPSS 0.4%CVE-2023-34012HIGHWordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-4100MEDIUMMultiple vulnerabilities in IDM Sistemas QSigeEPSS 0.4%CVE-2023-24420HIGHWordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-32257HIGHWinter: Stored XSS through Brand Settings custom stylesEPSS 0.4%CVE-2025-25092HIGHWordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2025-23535HIGHWordPress REAL WordPress Sidebar plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-53968MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-26566HIGHWordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50575MEDIUMIn JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APIEPSS 0.4%