Falhas do tipo CWE-79

30.190 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-24544HIGHWordPress Bitcoin and Altcoin Wallets plugin <= 6.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14320CRITICALXSS in Tegsoft's Online Support ApplicationEPSS 0.3%CVE-2023-40262MEDIUMAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site ScriptEPSS 0.3%CVE-2023-37933HIGHAn improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0EPSS 0.3%CVE-2024-47389HIGHWordPress NEX-Forms plugin <= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41706HIGHA stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentiallEPSS 0.3%CVE-2024-2634MEDIUMMultiple vulnerabilities on Meta4 HR from CegidEPSS 0.3%CVE-2024-37461HIGHWordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2015-20118MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via location_name ParameterEPSS 0.3%CVE-2025-57959MEDIUMWordPress Slightly troublesome permalink Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-28793MEDIUMIBM Engineering Workflow Management cross-site scriptingEPSS 0.3%CVE-2024-47638HIGHWordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73295MEDIUMMaterial for MkDocs: DOM XSS in search suggestions via query parameterEPSS 0.3%CVE-2025-57952MEDIUMWordPress Maps for WP Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-3937MEDIUMCross site scripting vulnerabilities in Snow License ManagerEPSS 0.3%CVE-2026-85484MEDIUMHTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escapingEPSS 0.3%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.3%CVE-2025-52344MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScriptEPSS 0.3%CVE-2025-7143MEDIUMSourceCodester Best Salon Management System Update Tax Page edit-tax.php cross site scriptingEPSS 0.3%CVE-2024-37459HIGHWordPress PayPlus Payment Gateway plugin <= 6.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%