Falhas do tipo CWE-79

29.955 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-22311HIGHWordPress Simply Schedule Appointments plugin <= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24666MEDIUMWordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11945MEDIUMEmail Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2024-54340HIGHWordPress Simple Presenter plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25148MEDIUMQwik SSR XSS via Unsafe Virtual Node SerializationEPSS 0.4%CVE-2024-11324MEDIUMAccounting for WooCommerce <= 1.6.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-95812MEDIUMClipBucket v5 before 5.5.3-#182 Reflected XSS via Query ParametersEPSS 0.4%CVE-2024-56022HIGHWordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8722MEDIUMWP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-12621MEDIUMYumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-54344HIGHWordPress WP Quick Shop plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30527MEDIUMWordPress My Bootstrap Menu plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52464HIGHWordPress amr shortcodes plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-0015MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)EPSS 0.4%CVE-2024-38680HIGHWordPress Appmaker plugin <= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54347HIGHWordPress FloristPress plugin <= 7.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11827MEDIUMOut of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query ShortcodeEPSS 0.4%CVE-2024-12501MEDIUMSimple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-48648MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject maliciouEPSS 0.4%CVE-2024-27192HIGHWordPress Configure SMTP Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%