Falhas do tipo CWE-79

29.926 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-10089MEDIUMInsert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)EPSS 0.4%CVE-2025-46944MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-22597HIGHWeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local_recepcao'EPSS 0.4%CVE-2023-23313MEDIUMCertain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's weEPSS 0.4%CVE-2025-46916MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-1946LOWSourceCodester Survey Application System Add New cross site scriptingEPSS 0.4%CVE-2024-45610MEDIUMGLPI has a reflected XSS in ajax/cable.phpEPSS 0.4%CVE-2026-13710MEDIUMJeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/WidgetEPSS 0.4%CVE-2026-13335MEDIUMCodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post MetaEPSS 0.4%CVE-2024-50965MEDIUMCross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbEPSS 0.4%CVE-2024-29776MEDIUMWordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8027MEDIUMStored Cross-Site Scripting (XSS) in netease-youdao/QAnythingEPSS 0.4%CVE-2026-18344MEDIUMResponsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' ParameterEPSS 0.4%CVE-2026-15285MEDIUMThe Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom AttributesEPSS 0.4%CVE-2024-5199MEDIUMSpotify Play Button <= 1.0 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-38949HIGHCross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image EPSS 0.4%CVE-2024-33639MEDIUMWordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-37527MEDIUMA cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformEPSS 0.4%CVE-2023-3538LOWSimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2024-33918MEDIUMWordPress AJAX Login and Registration modal popup + inline form plugin <= 2.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%