Falhas do tipo CWE-79

29.814 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-13397MEDIUMWPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11974MEDIUMMedia Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action ParametersEPSS 0.4%CVE-2024-8786MEDIUMAuto Featured Image from Title <= 2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-70486HIGHOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2026-15306MEDIUMProduct Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search ParameterEPSS 0.4%CVE-2026-4246MEDIUMElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' ParameterEPSS 0.4%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.4%CVE-2022-44631MEDIUMWordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-75586MEDIUMUnlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' ParameterEPSS 0.4%CVE-2023-23878MEDIUMWordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-43461MEDIUMWordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23700HIGHWordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13396MEDIUMFrictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-50745MEDIUMA missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did EPSS 0.4%CVE-2026-90981MEDIUMNewsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' ParameterEPSS 0.4%CVE-2025-23696HIGHWordPress Staging CDN plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25551MEDIUMCross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code EPSS 0.4%CVE-2026-4394MEDIUMGravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldEPSS 0.4%CVE-2024-43370HIGHgettext.js vulnerable to cross-site scripting (XSS)EPSS 0.4%CVE-2020-36853HIGH10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings ChangeEPSS 0.4%