Falhas do tipo CWE-79

30.097 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-2083MEDIUMLogo Carousel Gutenberg Block <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId ParameterEPSS 0.3%CVE-2024-25592MEDIUMWordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51859MEDIUMWordPress Bamboo Enquiries plugin <= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-96878MEDIUMCargo Exhibit field alias allows stored XSSEPSS 0.3%CVE-2026-103489LOWIn JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possibleEPSS 0.3%CVE-2024-32801MEDIUMWordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51860MEDIUMWordPress Custom Dashboard Widget plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-7251MEDIUMWordPress User Submitted Posts plugin <= 20230901 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22243HIGHVMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.EPSS 0.3%CVE-2024-47075MEDIUMDOM Clobbering gadgets found in layui that lead to Cross-site ScriptingEPSS 0.3%CVE-2025-6256MEDIUMFlex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect ParameterEPSS 0.3%CVE-2020-36978MEDIUMFroxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2024-30180MEDIUMWordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12819MEDIUMSearchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%CVE-2024-33692MEDIUMWordPress Smart Recent Posts Widget plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12599MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2026-25759HIGHStatmatic affected by privilege escalation via stored cross-site scriptingEPSS 0.3%CVE-2025-8812MEDIUMatjiu pybbs Admin Panel settings cross site scriptingEPSS 0.3%CVE-2026-73703HIGHUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 0.3%