Falhas do tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-64710MEDIUMBitplatform Boilerplate has cross-site scripting vulnerabilityEPSS 0.3%CVE-2024-3603MEDIUMOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-36468MEDIUMCross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL paramEPSS 0.3%CVE-2024-32674MEDIUMHeateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitraEPSS 0.3%CVE-2024-49378MEDIUMsmartUp Cross-site Scripting vulnerabilityEPSS 0.3%CVE-2024-55864MEDIUMCross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative userEPSS 0.3%CVE-2024-10226MEDIUMArconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box ShortcodeEPSS 0.3%CVE-2026-75170MEDIUMCross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote uEPSS 0.3%CVE-2023-32088MEDIUM Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation EPSS 0.3%CVE-2025-62693MEDIUMStored XSS through system messages in LastModifiedEPSS 0.3%CVE-2023-27990MEDIUMThe cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50EPSS 0.3%CVE-2025-69848MEDIUMNetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulneraEPSS 0.3%CVE-2024-10147MEDIUMSteel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn ShortcodeEPSS 0.3%CVE-2024-13822MEDIUMTotal Contest Lite <= 2.8.1 - Reflected XSSEPSS 0.3%CVE-2026-53668MEDIUMReact Router: Open redirect can lead to XSSEPSS 0.3%CVE-2024-6705MEDIUMRegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2024-27095MEDIUMDecidim cross-site scripting (XSS) in the admin panelEPSS 0.3%CVE-2024-3925MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick eventsEPSS 0.3%CVE-2025-62700MEDIUMStored XSS through a system message in MultiBoilerplateEPSS 0.3%