Falhas do tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-10260HIGHTripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File UploadEPSS 0.4%CVE-2026-33035MEDIUMUnauthenticated Reflected XSS via innerHTML in AVideoEPSS 0.4%CVE-2024-1810MEDIUMArchivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-40328MEDIUMWordPress Carrot Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30485HIGHWordPress Avartan Slider Lite Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49184MEDIUMWordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-36993MEDIUMPersistent Cross-site Scripting (XSS) in Web BulletinEPSS 0.4%CVE-2026-8884MEDIUMInstant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%CVE-2024-11331MEDIUMisee-products-extractor <= 2.1.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-84219HIGHKirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity DecodingEPSS 0.4%CVE-2024-8276MEDIUMWPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.4%CVE-2024-10099MEDIUMStored XSS in comfyanonymous/comfyuiEPSS 0.4%CVE-2024-4643MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-21046MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.4%CVE-2024-25700MEDIUMPersistent XSS in URL added to a shared mapEPSS 0.4%CVE-2025-26065HIGHA cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts oEPSS 0.4%CVE-2023-0258LOWSourceCodester Online Food Ordering System Category List cross site scriptingEPSS 0.4%CVE-2026-0586MEDIUMcode-projects Online Product Reservation System prod.php cross site scriptingEPSS 0.4%CVE-2024-25708MEDIUMPersistent XSS when creating new application using Web App BuilderEPSS 0.4%CVE-2026-6817MEDIUMQuiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'EPSS 0.4%