Falhas do tipo CWE-79

29.952 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-73084MEDIUMActivepieces: Reflected Cross-Site Scripting in OAuth Redirect EndpointEPSS 0.4%CVE-2026-15650MEDIUMRT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block AttributeEPSS 0.4%CVE-2026-15297MEDIUMNewsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-90602MEDIUMAnil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scriptingEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-22725MEDIUMOrthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the seEPSS 0.4%CVE-2024-50551MEDIUMWordPress EndomondoWP plugin <= 0.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-37980MEDIUMOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageEPSS 0.4%CVE-2025-11450MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-21584MEDIUMPleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a sEPSS 0.4%CVE-2024-2258MEDIUMForm Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.4%CVE-2024-25898MEDIUMA XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in thEPSS 0.4%CVE-2024-50549MEDIUMWordPress Bonway Static Block Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-41241MEDIUMWordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50552MEDIUMWordPress Hover Video Preview plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6228MEDIUMSina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` WidgetsEPSS 0.4%CVE-2025-11449MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-6340MEDIUMPremium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%CVE-2024-4564MEDIUMCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-5485MEDIUMSureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link ShortcodeEPSS 0.4%