Falhas do tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-52430MEDIUMThe caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eithEPSS 0.4%CVE-2024-31741MEDIUMCross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after logiEPSS 0.4%CVE-2024-12047MEDIUMWP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server ParameterEPSS 0.4%CVE-2024-34240MEDIUMQDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to addEPSS 0.4%CVE-2024-31609HIGHCross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields EPSS 0.4%CVE-2025-3056MEDIUMDownload Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-46925MEDIUMReportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-9030MEDIUMCodeCanyon CRMGo SaaS note cross site scriptingEPSS 0.4%CVE-2024-10883MEDIUMSimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-77792HIGHRegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating FieldEPSS 0.4%CVE-2024-6725MEDIUMFormidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-25697MEDIUMStored XSS in Portal for ArcGISEPSS 0.4%CVE-2024-12422MEDIUMImport Eventbrite Events <= 1.7.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-5955MEDIUMCross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-11203MEDIUMEmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'EPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-53904LOWThe Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-4579HIGHWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report FieldsEPSS 0.4%CVE-2024-10034MEDIUMGallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.4%