Falhas do tipo CWE-79

30.201 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-4329HIGHBlackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP HeaderEPSS 0.3%CVE-2026-114128MEDIUMAstro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingEPSS 0.3%CVE-2023-50889MEDIUMWordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-49700HIGHWordPress ARPrice plugin <= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-15790MEDIUMVideo Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta ShortcodeEPSS 0.3%CVE-2024-5092MEDIUMElegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox WidgetsEPSS 0.3%CVE-2024-5640MEDIUMPrime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific WidgetEPSS 0.3%CVE-2026-75134MEDIUMSEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onloadEPSS 0.3%CVE-2024-11930MEDIUMTaskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks ShortcodeEPSS 0.3%CVE-2026-10570MEDIUMSympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field ValuesEPSS 0.3%CVE-2025-10117MEDIUMSourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scriptingEPSS 0.3%CVE-2024-21133MEDIUMVulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Servlet). Supported versions that are affecteEPSS 0.3%CVE-2022-22456MEDIUMIBM Security Verify Governance, Identity Manager cross-site scriptingEPSS 0.3%CVE-2024-5259MEDIUMMultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation ParameterEPSS 0.3%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2025-71419MEDIUMUVdesk core-framework before 1.1.7 Stored XSS via SwiftMailerEPSS 0.3%CVE-2023-0926MEDIUMCustom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5006MEDIUMBoostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size ParameterEPSS 0.3%CVE-2026-11328MEDIUMExclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2025-1467MEDIUMVersions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(EPSS 0.3%