Falhas do tipo CWE-79

29.953 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-9885MEDIUMWidget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-37161MEDIUMMeterSphere front-end editor stores XSS vulnerabilityEPSS 0.4%CVE-2026-1134MEDIUMitsourcecode Society Management System expenses.php cross site scriptingEPSS 0.4%CVE-2024-20270MEDIUMA vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended ServiceEPSS 0.4%CVE-2025-5179MEDIUMRealce Tecnologia Queue Ticket Kiosk Cadastro de Administrador Page index.php cross site scriptingEPSS 0.4%CVE-2026-42849CRITICALauthentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeoverEPSS 0.4%CVE-2025-63589HIGHA reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encodEPSS 0.4%CVE-2024-50520MEDIUMWordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6200HIGHHaloITSM - Stored Cross-Site Scripting in TicketsEPSS 0.4%CVE-2024-1377MEDIUMHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta WidgetEPSS 0.4%CVE-2024-51799MEDIUMWordPress Bg Patriarchia BU plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9886MEDIUMWP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-25365HIGHCross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3EPSS 0.4%CVE-2025-65442MEDIUMDOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code orEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2337MEDIUMEasy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-10367MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-1028LOWSourceCodester Facebook News Feed Like Post cross site scriptingEPSS 0.4%CVE-2024-31928MEDIUMWordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52283MEDIUMMissing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectEPSS 0.4%