Falhas do tipo CWE-79

29.816 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-2371MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingEPSS 0.4%CVE-2024-13591MEDIUMTeam Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-26493MEDIUMIn JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tabEPSS 0.4%CVE-2025-59332HIGH3DAlloy allows stored XSS through attributes provided to the 3d parser tag/functionEPSS 0.4%CVE-2024-25226MEDIUMA cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2026-36214MEDIUMosTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip cEPSS 0.4%CVE-2024-11746MEDIUMDiscover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-47814MEDIUMWordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2087HIGHBrizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via FormEPSS 0.4%CVE-2025-0314HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2023-2343MEDIUMCross-site Scripting (XSS) - DOM in pimcore/pimcoreEPSS 0.4%CVE-2023-4021MEDIUMModern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12435MEDIUMCompare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-13575MEDIUMWeb Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-46734MEDIUMleague/commonmark Cross-site Scripting vulnerability in Attributes extensionEPSS 0.4%CVE-2025-1955MEDIUMcode-projects Online Class and Exam Scheduling System profile.php cross site scriptingEPSS 0.4%CVE-2024-9609MEDIUMLearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12077MEDIUMBooking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'EPSS 0.4%CVE-2023-30469HIGHReflrected Cross Site Scripting Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.4%CVE-2023-5230MEDIUMTM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%