Falhas do tipo CWE-79

30.199 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-3966MEDIUMPray For Me <= 1.0.4 - Unauthenticated Stored XSSEPSS 0.3%CVE-2025-56154MEDIUMhtmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is noEPSS 0.3%CVE-2026-44651MEDIUMSillyTavern: Reflected XSS vulnerability in the CORS proxy middlewareEPSS 0.3%CVE-2024-32566MEDIUMWordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-55230HIGHVvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than characterEPSS 0.3%CVE-2024-10342MEDIUMLeague of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-5651MEDIUMcode-projects Traffic Offense Reporting System saveuser.php cross site scriptingEPSS 0.3%CVE-2026-27196HIGHStatamic affected by privilege escalation via stored Cross-site ScriptingEPSS 0.3%CVE-2025-5314MEDIUMDear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'EPSS 0.3%CVE-2025-49461MEDIUMZoom Workplace Clients - Cross-site ScriptingEPSS 0.3%CVE-2025-24731MEDIUMWordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13868MEDIUMEasy Broken Link Checker <= 9.0.2 - Reflected XSSEPSS 0.3%CVE-2026-34568CRITICALCI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-82890MEDIUMIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.3%CVE-2023-6498MEDIUMComplianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settingsEPSS 0.3%CVE-2023-44915HIGHA cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripEPSS 0.3%CVE-2024-32564MEDIUMWordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52358MEDIUMA cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 andEPSS 0.3%CVE-2024-24097MEDIUMCross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News FEPSS 0.3%CVE-2024-22130HIGHCross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UIEPSS 0.3%