Falhas do tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-20377MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attackEPSS 0.4%CVE-2024-42697MEDIUMCross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary cEPSS 0.4%CVE-2023-32296HIGHWordPress Kangu para WooCommerce Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-12705HIGHSocial Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media ReviewsEPSS 0.4%CVE-2024-1782MEDIUMBlue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'EPSS 0.4%CVE-2025-47092MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-37997HIGHWordPress Post List With Featured Image Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-0848MEDIUMAA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoiceEPSS 0.4%CVE-2024-33997MEDIUMmoodle: stored XSS risk when editing another user's equation in equation editorEPSS 0.4%CVE-2023-25483MEDIUMWordPress Easy Coming Soon Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27622MEDIUMWordPress GuruWalk Affiliates Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-48527HIGHHaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpointEPSS 0.4%CVE-2024-47640HIGHWordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-4482MEDIUMAuto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via styleEPSS 0.4%CVE-2024-32567HIGHWordPress DirectoryPress plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-1320MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-34175HIGHWordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-32034MEDIUMCross-site scripting (XSS) in the decidim admin activity logEPSS 0.4%CVE-2023-49272MEDIUMHotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-0957MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%