Falhas do tipo CWE-79

29.991 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-10566MEDIUMCampcodes Grocery Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2026-16205MEDIUMPluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scriptingEPSS 0.4%CVE-2023-51068MEDIUMAn authenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers EPSS 0.4%CVE-2023-51312MEDIUMPHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date EPSS 0.4%CVE-2025-7866MEDIUMPortabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scriptingEPSS 0.4%CVE-2024-9031MEDIUMCodeCanyon CRMGo SaaS show cross site scriptingEPSS 0.4%CVE-2025-24017HIGHYesWiki Vulnerable to Unauthenticated DOM Based XSSEPSS 0.4%CVE-2025-10614MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scriptingEPSS 0.4%CVE-2021-47914MEDIUMPHP Melody 3.0 Persistent XSS Vulnerability via Edit Video ParameterEPSS 0.4%CVE-2025-56320MEDIUMCobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) in its chat box component. ThiEPSS 0.4%CVE-2025-0104HIGHExpedition: Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2026-19110MEDIUMDataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scriptingEPSS 0.4%CVE-2026-59814HIGHJoplin: Stored XSS via inline-served note attachment on published sharesEPSS 0.4%CVE-2024-4417MEDIUMFalang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-94150MEDIUMOmega Solution HRM OS SVG File Upload view cross site scriptingEPSS 0.4%CVE-2023-51315MEDIUMPHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key,EPSS 0.4%CVE-2023-51330MEDIUMPHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter.EPSS 0.4%CVE-2024-37625MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.phpEPSS 0.3%CVE-2024-8858MEDIUMElementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings ParameterEPSS 0.3%CVE-2026-12170MEDIUMAcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' AttributeEPSS 0.3%