Falhas do tipo CWE-79

30.092 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-32740MEDIUMWordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25936MEDIUMWordPress SoundCloud Shortcode plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1209MEDIUMcode-projects Wazifa System search_resualts.php searchuser cross site scriptingEPSS 0.3%CVE-2026-87760HIGHWeb Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric NameEPSS 0.3%CVE-2024-2139MEDIUMMaster Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table WidgetEPSS 0.3%CVE-2023-32119MEDIUMWordPress WPO365 | Mail Integration for Office 365 / Outlook Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-2170MEDIUMVK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via classNameEPSS 0.3%CVE-2025-32465HIGHExtension - rsjoomla.com - Stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for JoomlaEPSS 0.3%CVE-2023-52048MEDIUMRuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.EPSS 0.3%CVE-2024-2108MEDIUMNinja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-28784MEDIUMIBM QRadar cross-site scriptingEPSS 0.3%CVE-2024-2732MEDIUMThemify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2143MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading WidgetEPSS 0.3%CVE-2024-4277MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html ParameterEPSS 0.3%CVE-2025-60737MEDIUMCross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remoteEPSS 0.3%CVE-2024-29111MEDIUMWordPress Sitekit plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-33170MEDIUMRails Active Support has a possible XSS vulnerability in SafeBuffer#%EPSS 0.3%CVE-2025-57393HIGHA stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to exEPSS 0.3%CVE-2024-3730MEDIUMSimple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-1577MEDIUMcode-projects Blood Bank System prostatus.php cross site scriptingEPSS 0.3%