Falhas do tipo CWE-79

30.194 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-12126MEDIUMSEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error ParameterEPSS 0.3%CVE-2025-3661MEDIUMSB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-53307MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitraryEPSS 0.3%CVE-2025-10255MEDIUMAscensio System SIA OnlyOffice Comment Messages.aspx cross site scriptingEPSS 0.3%CVE-2024-43233HIGHWordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-106512HIGHMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSEPSS 0.3%CVE-2025-61457MEDIUMcode16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.EPSS 0.3%CVE-2023-50860MEDIUMWordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-3814MEDIUMTax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name ParameterEPSS 0.3%CVE-2026-48164MEDIUMCollabora Online: Reflected HTML injection through host_session_idEPSS 0.3%CVE-2023-4604MEDIUMSlideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'EPSS 0.3%CVE-2025-0521HIGHPost SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-62413MEDIUMMQTTX vulnerable to cross-site scripting via improper message payload renderingEPSS 0.3%CVE-2024-48622MEDIUMA cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/editEPSS 0.3%CVE-2024-54224MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32961MEDIUMCUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download EndpointEPSS 0.3%CVE-2024-30886MEDIUMA stored cross-site scripting (XSS) vulnerability in the remotelink function of HadSky v7.6.3 allows attackers to execute arbitrary web scriEPSS 0.3%CVE-2024-43793MEDIUMHalo's editor has a stored XSS vulnerabilityEPSS 0.3%CVE-2025-1457MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-22559MEDIUMLightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.EPSS 0.3%