Falhas do tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-20367MEDIUMA vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-siteEPSS 0.4%CVE-2023-3369MEDIUMAbout Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5955MEDIUMCross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aEPSS 0.4%CVE-2026-23525MEDIUM1panel App Store vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2025-22388MEDIUMAn issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exiEPSS 0.4%CVE-2024-8241MEDIUMNova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.4%CVE-2024-27993HIGHWordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-74932HIGHWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningEPSS 0.4%CVE-2023-6720MEDIUMCross-site Scripting in RepoxEPSS 0.4%CVE-2023-1575MEDIUMMega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-8742MEDIUMEssential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery WidgetEPSS 0.4%CVE-2024-22547MEDIUMWayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-11203MEDIUMEmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'EPSS 0.4%CVE-2024-43417MEDIUMReflected XSS in Software formEPSS 0.4%CVE-2026-16573HIGHBit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature UploadEPSS 0.4%CVE-2025-4579HIGHWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report FieldsEPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-31256HIGHWordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%