Falhas do tipo CWE-79

29.817 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-6882MEDIUMSimple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_modeEPSS 0.4%CVE-2026-92385MEDIUMSourceCodester Online Food Ordering System Category Update update_category.php cross site scriptingEPSS 0.4%CVE-2021-47857MEDIUMMoodle 3.10.3 - 'label' Persistent Cross Site ScriptingEPSS 0.4%CVE-2024-51816MEDIUMWordPress Banner System plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-48336MEDIUMWordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-48780MEDIUMWordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51827MEDIUMWordPress Boombox Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12348MEDIUMGuizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scriptingEPSS 0.4%CVE-2025-40644MEDIUMReflected Cross-Site Scripting (XSS) in QRGen's RiftzillaEPSS 0.4%CVE-2023-48289MEDIUMWordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50538MEDIUMWordPress Show Visitor IP Address plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-51828MEDIUMWordPress Beacon For Help Scout plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-1819HIGHStored XSS in Karel Electronics' ViPortEPSS 0.4%CVE-2026-7013MEDIUMMaxSite CMS mail_send Plugin cross site scriptingEPSS 0.4%CVE-2023-49179MEDIUMWordPress Event post Plugin <= 5.8.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9143MEDIUMScada-LTS mailing_lists.shtm cross site scriptingEPSS 0.4%CVE-2024-2948MEDIUMFavorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-50370MEDIUMWordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-46655MEDIUMA reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a usEPSS 0.4%CVE-2026-7012MEDIUMMaxSite CMS Redirect Plugin cross site scriptingEPSS 0.4%