Falhas do tipo CWE-79

29.814 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-25113HIGHWordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-53968MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-25092HIGHWordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-46091MEDIUMCross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arEPSS 0.4%CVE-2025-26564HIGHWordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25491LOWCraft has a Stored XSS in Entry Types NameEPSS 0.4%CVE-2024-1160MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon LinkEPSS 0.4%CVE-2025-26566HIGHWordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-0630MEDIUMWP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed SourceEPSS 0.4%CVE-2025-25070HIGHWordPress Album Reviewer plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25099HIGHWordPress Appointment Buddy Widget By Accrete plugin <= 1.2. - Reflected Cross-Site Scripting vulnerabilityEPSS 0.4%CVE-2025-51541MEDIUMA stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuratioEPSS 0.4%CVE-2026-25486MEDIUMCraft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege EscalationEPSS 0.4%CVE-2025-26565HIGHWordPress GNUPress Plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25041MEDIUMIBM Cognos Analytics cross-site scriptingEPSS 0.4%CVE-2020-22402MEDIUMCross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reaEPSS 0.4%CVE-2025-0339MEDIUMcode-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scriptingEPSS 0.4%CVE-2025-6126MEDIUMPHPGurukul Rail Pass Management System contact.php cross site scriptingEPSS 0.4%CVE-2024-53967MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-1123HIGHSolid Mail – SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.4%