Falhas do tipo CWE-79

30.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-35234MEDIUMDiscourse vulnerable to stored-dom XSS via Facebook OneboxesEPSS 0.3%CVE-2025-67823HIGHA vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could alEPSS 0.3%CVE-2023-46074MEDIUMWordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10178MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2024-3889MEDIUMRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title TagsEPSS 0.3%CVE-2024-24801MEDIUMWordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-9353MEDIUMThemify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-57440HIGHMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledEPSS 0.3%CVE-2026-30562CRITICALA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-2635MEDIUMDigital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg FunctionEPSS 0.3%CVE-2024-32570HIGHWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56299HIGHWordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-54774MEDIUMDcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.EPSS 0.3%CVE-2025-3613MEDIUMDemtec Graphytics visualization cross site scriptingEPSS 0.3%CVE-2025-47056MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2026-3368HIGHInjection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter NameEPSS 0.3%CVE-2025-47005MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-3559MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]EPSS 0.3%CVE-2024-56016HIGHWordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51646HIGHWordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%