Falhas do tipo CWE-79

30.149 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-5727MEDIUMSourceCodester Student Result Management System Announcement Page announcement cross site scriptingEPSS 0.3%CVE-2025-5584MEDIUMPHPGurukul Hospital Management System POST Parameter edit-patient.php cross site scriptingEPSS 0.3%CVE-2024-20525MEDIUMCisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2023-51361MEDIUMWordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-10104MEDIUMProduct Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail ParameterEPSS 0.3%CVE-2024-43024MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary wEPSS 0.3%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.3%CVE-2024-54043MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-10112MEDIUMSimple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news ShortcodeEPSS 0.3%CVE-2023-6776MEDIUM3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready FunctionEPSS 0.3%CVE-2026-12108MEDIUMHighlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' SettingEPSS 0.3%CVE-2024-1508MEDIUMPrime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury WidgetEPSS 0.3%CVE-2025-51860MEDIUMStored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. An attacker cEPSS 0.3%CVE-2025-52203HIGHA stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket NEPSS 0.3%CVE-2024-47612LOWXSS in Special:DataDump when displaying dump statusEPSS 0.3%CVE-2024-32428MEDIUMWordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-39933MEDIUMMultiple XSS vulnerabilities in GlobalWatchlistEPSS 0.3%CVE-2024-44001MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54048MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-5726MEDIUMSourceCodester Student Result Management System Division System Page division-system cross site scriptingEPSS 0.3%