Falhas do tipo CWE-79

29.882 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-31476MEDIUMtarteaucitron.js allows url scheme injection via unfiltered inputsEPSS 0.4%CVE-2025-49428HIGHWordPress Cookie Warning plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-30437MEDIUMWordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-39520MEDIUMWordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-37563MEDIUMWordPress TOCHAT.BE plugin <= 1.3.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-21627MEDIUMGLPI Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%CVE-2025-39516MEDIUMWordPress Author WIP Progress Bar plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-54814MEDIUMA reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. AEPSS 0.4%CVE-2025-15283HIGHName Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple ParametersEPSS 0.4%CVE-2025-4669MEDIUMBooking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc ShortcodeEPSS 0.4%CVE-2023-50880MEDIUMWordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-35345MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts unidentified code within the filEPSS 0.4%CVE-2024-29764MEDIUMWordPress Molongui plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-39555MEDIUMWordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29789MEDIUMWordPress OneClick Chat to Order plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13013MEDIUMPHPGurukul Maid Hiring Management System Contact Us Page contactus.php cross site scriptingEPSS 0.4%CVE-2024-30450MEDIUMWordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-41364MEDIUMStored Cross-Site Scripting (XSS) vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-23362MEDIUMThe old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an EPSS 0.4%