Falhas do tipo CWE-79

29.870 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-7869HIGH123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-4341MEDIUMPrime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' ParameterEPSS 0.4%CVE-2023-41657MEDIUMWordPress HollerBox Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41731MEDIUMWordPress wordpress publish post email notification Plugin <= 1.0.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-46182MEDIUMIBM Secure Proxy cross-site scriptingEPSS 0.4%CVE-2023-37986MEDIUMWordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-35595MEDIUMAn arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary codeEPSS 0.4%CVE-2024-35153MEDIUMIBM WebSphere Application Server cross-site scriptingEPSS 0.4%CVE-2026-4951MEDIUMReflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystemEPSS 0.4%CVE-2024-46055MEDIUMOpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.EPSS 0.4%CVE-2023-45630HIGHWordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25465MEDIUMWordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-109193HIGHHivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute ValueEPSS 0.4%CVE-2024-49248HIGHWordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4785MEDIUMLatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-22602MEDIUMStored DOM-based XSS (without CSP) via video placeholders in DiscourseEPSS 0.4%CVE-2023-41855MEDIUMWordPress Regpack Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-56328MEDIUMHTMLi(XSS without CSP) via Onebox urls in DiscourseEPSS 0.4%CVE-2024-11973MEDIUMQuran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang ParametersEPSS 0.4%CVE-2023-33210MEDIUMWordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%