Falhas do tipo CWE-79

30.149 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-50166MEDIUMPega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.EPSS 0.3%CVE-2024-56237MEDIUMWordPress Contest Gallery plugin <= 24.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13140MEDIUMEmlog Pro Cover Upload article.php cross site scriptingEPSS 0.3%CVE-2025-60374MEDIUMStored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is exEPSS 0.3%CVE-2024-29935MEDIUMWordPress Sina Extension for Elementor plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-33230MEDIUMnltk Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2024-51446MEDIUMA vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of thEPSS 0.3%CVE-2024-11489MEDIUM115cms file.html cross site scriptingEPSS 0.3%CVE-2026-9519MEDIUMstonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scriptingEPSS 0.3%CVE-2024-10250MEDIUMNioland <= 1.2.6 - Reflected Cross-Site Scripting via sEPSS 0.3%CVE-2024-45985MEDIUMA Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to injEPSS 0.3%CVE-2026-9520MEDIUMblitz-js blitz Sign-in LoginForm.tsx cross site scriptingEPSS 0.3%CVE-2024-37437MEDIUMWordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerabilityEPSS 0.3%CVE-2024-9382MEDIUMGantry 4 Framework <= 4.1.21 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-50836MEDIUMWordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-51695MEDIUMWordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-85453MEDIUMMOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-50829MEDIUMWordPress Loan Repayment Calculator and Application Form Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-9738MEDIUMPrint, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' ParameterEPSS 0.3%CVE-2026-12430MEDIUMBlocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' ParameterEPSS 0.3%