Falhas do tipo CWE-79

30.186 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-13377HIGHGravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterEPSS 0.3%CVE-2024-0845MEDIUMPDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via renderEPSS 0.3%CVE-2024-10706MEDIUMDownload Manager < 3.3.03 - Admin+ Stored XSSEPSS 0.3%CVE-2024-6896MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-6575MEDIUMThe Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll WidgetEPSS 0.3%CVE-2024-8318MEDIUMAttributes for Blocks <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks ParameterEPSS 0.3%CVE-2024-47298MEDIUMWordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4376MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetEPSS 0.3%CVE-2025-2166MEDIUMCM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-6929MEDIUMDynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured ParameterEPSS 0.3%CVE-2024-25691MEDIUMBUG-000165286 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-24742MEDIUMCross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)EPSS 0.3%CVE-2024-6627MEDIUMHappy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View WidgetEPSS 0.3%CVE-2024-6629MEDIUMAll-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ShortcodeEPSS 0.3%CVE-2024-5192MEDIUMFunnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2024-5226MEDIUMFuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2025-46996MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-9655MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon WidgetEPSS 0.3%CVE-2025-14112MEDIUMSnillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode AttributeEPSS 0.3%CVE-2024-28233HIGHXSS in JupyterHub via Self-XSS leveraged by Cookie TossingEPSS 0.3%