Falhas do tipo CWE-79

29.817 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-5230MEDIUMTM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-2974MEDIUMCodeCanyon Perfex CRM Contracts contract cross site scriptingEPSS 0.4%CVE-2024-5849HIGHPepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSSEPSS 0.4%CVE-2023-32746MEDIUMWordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-6692LOWEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement TextEPSS 0.4%CVE-2023-28171MEDIUMWordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45609MEDIUMWordPress Powr Pack Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47872MEDIUMWordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9144MEDIUMScada-LTS publisher_edit.shtm cross site scriptingEPSS 0.4%CVE-2026-40922MEDIUMSiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)EPSS 0.4%CVE-2023-50368MEDIUMWordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51846MEDIUMWordPress Community Yard Sale plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-32793MEDIUMWordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-7016MEDIUMMaxSite CMS ushki Plugin cross site scriptingEPSS 0.4%CVE-2024-51851MEDIUMWordPress best bootstrap widgets for elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50518MEDIUMWordPress Pricer Ninja plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54443MEDIUMWordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9638MEDIUMCategory Posts Widget < 4.9.18 - Admin+ Stored XSSEPSS 0.4%CVE-2023-50369MEDIUMWordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51322MEDIUMCross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via thEPSS 0.4%