Falhas do tipo CWE-79

29.818 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-8364MEDIUMWP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset ShortcodeEPSS 0.4%CVE-2024-9344MEDIUMBerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28001HIGHWordPress Favicon Rotator plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-12450MEDIUMLiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%CVE-2024-24879HIGHWordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-31510HIGHIn the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (intEPSS 0.4%CVE-2024-27999HIGHWordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-41519MEDIUMFeripro <= v2.2.3 is vulnerable to Cross Site Scripting (XSS) via "/admin/programm/<program_id>/zuordnung/veranstaltungen/<event_id>" througEPSS 0.4%CVE-2024-30447HIGHWordPress Creative Image Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6344MEDIUMZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scriptingEPSS 0.4%CVE-2024-29470MEDIUMOneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.EPSS 0.4%CVE-2024-36359MEDIUMA cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to esEPSS 0.4%CVE-2024-21154MEDIUMVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported veEPSS 0.4%CVE-2023-41691HIGHWordPress WooCommerce PensoPay Plugin <= 6.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2082HIGHEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-49747MEDIUMWordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44987MEDIUMWordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-24771MEDIUMHono has a Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2023-40560MEDIUMWordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%