Falhas do tipo CWE-79

30.188 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-12320MEDIUMTeam Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'EPSS 0.3%CVE-2025-14112MEDIUMSnillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode AttributeEPSS 0.3%CVE-2024-28233HIGHXSS in JupyterHub via Self-XSS leveraged by Cookie TossingEPSS 0.3%CVE-2024-10706MEDIUMDownload Manager < 3.3.03 - Admin+ Stored XSSEPSS 0.3%CVE-2024-0845MEDIUMPDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via renderEPSS 0.3%CVE-2024-9655MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon WidgetEPSS 0.3%CVE-2024-5226MEDIUMFuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-6629MEDIUMAll-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ShortcodeEPSS 0.3%CVE-2024-5192MEDIUMFunnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2025-46996MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2021-47917MEDIUMSimple CMS 2.1 Persistent Cross-Site Scripting via User Input ParametersEPSS 0.3%CVE-2025-12739HIGHCross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseEPSS 0.3%CVE-2025-2164MEDIUMpixelstats <= 0.8.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-25691MEDIUMBUG-000165286 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-9388MEDIUMBlack Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-38038MEDIUMBUG-000165732 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-6870MEDIUMResponsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-8282MEDIUMIbtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.3%CVE-2025-46993MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47061MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%