Falhas do tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-4821MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox ShortcodeEPSS 0.3%CVE-2024-3639MEDIUMElementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts GridEPSS 0.3%CVE-2026-50742MEDIUMA stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. TEPSS 0.3%CVE-2024-32573MEDIUMWordPress WP-Lister Lite for eBay plugin <=3.5.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9642MEDIUMEditor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-49316HIGHWordPress WP2LEADS plugin <= 3.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-53918MEDIUMPodcastGenerator Stored Cross-Site Scripting via Episode Title FieldEPSS 0.3%CVE-2025-62700MEDIUMStored XSS through a system message in MultiBoilerplateEPSS 0.3%CVE-2024-10226MEDIUMArconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box ShortcodeEPSS 0.3%CVE-2024-6229MEDIUMStored XSS in stangirard/quivrEPSS 0.3%CVE-2024-13822MEDIUMTotal Contest Lite <= 2.8.1 - Reflected XSSEPSS 0.3%CVE-2024-6705MEDIUMRegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-32087MEDIUM Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation EPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2023-23898MEDIUMWordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-3603MEDIUMOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-69848MEDIUMNetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulneraEPSS 0.3%CVE-2024-55864MEDIUMCross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative userEPSS 0.3%CVE-2024-49378MEDIUMsmartUp Cross-site Scripting vulnerabilityEPSS 0.3%CVE-2024-32674MEDIUMHeateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitraEPSS 0.3%