Falhas do tipo CWE-79

29.882 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-9647MEDIUMmtons mblog list cross site scriptingEPSS 0.4%CVE-2024-10493MEDIUMElement Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-71565MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75702MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75635MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-41809HIGHOpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`EPSS 0.4%CVE-2024-41453MEDIUMA cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HEPSS 0.4%CVE-2026-75712MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-51142MEDIUMCross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storEPSS 0.4%CVE-2023-40153MEDIUMCross-site Scripting in DEXMA DEXGateEPSS 0.4%CVE-2024-34366MEDIUMWordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-75720MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-34375MEDIUMWordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-3965MEDIUMitwanger paicoding post cross site scriptingEPSS 0.4%CVE-2026-75669MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-64542MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75691MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2025-0511HIGHWelcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name ParameterEPSS 0.4%CVE-2025-3970MEDIUMbaseweb JSite save cross site scriptingEPSS 0.4%CVE-2026-75657MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%