Falhas do tipo CWE-79

30.098 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-73703HIGHUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 0.3%CVE-2024-20460MEDIUMCisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-91922MEDIUMSteedos Platform through 3.0.15-beta.47 Reflected XSS via page renderEPSS 0.3%CVE-2025-8812MEDIUMatjiu pybbs Admin Panel settings cross site scriptingEPSS 0.3%CVE-2024-33696MEDIUMWordPress WordPress Ad Widget plugin <= 2.20.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1945HIGHWPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' ParametersEPSS 0.3%CVE-2026-1654MEDIUMPeter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2024-32540MEDIUMWordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12599MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2024-47782HIGHCross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscoverEPSS 0.3%CVE-2025-57538MEDIUMA stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual EnvirEPSS 0.3%CVE-2026-55779MEDIUMSilverstripe Versioned: XSS in archive admin restoreEPSS 0.3%CVE-2024-41482MEDIUMTypora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.EPSS 0.3%CVE-2019-25453MEDIUMphpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.phpEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%CVE-2024-3944MEDIUMWP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task CommentsEPSS 0.3%CVE-2026-59795HIGHIn JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possibleEPSS 0.3%CVE-2024-29922MEDIUMWordPress Slider Hero plugin <= 8.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59710MEDIUMshowdown - Stored XSS via Unescaped Table Header ID Attribute InjectionEPSS 0.3%