Falhas do tipo CWE-79

30.250 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-36234MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2021-3030MEDIUMCute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in coloEPSS 0.3%CVE-2026-113657LOWApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)EPSS 0.3%CVE-2025-57764MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'EPSS 0.3%CVE-2024-53731MEDIUMWordPress Fintelligence Calculator plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36233MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-23874HIGHWordPress WP Block Pack plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7760HIGHReflected XSS in Ofisimo's Association Web Package FloraEPSS 0.3%CVE-2026-41240MEDIUMDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)EPSS 0.3%CVE-2023-32715MEDIUMSelf Cross-Site Scripting (XSS) on Splunk App for Lookup File EditingEPSS 0.3%CVE-2026-93339MEDIUMDitty < 3.1.70 Stored XSS via Layout Tag Wrapper AttributeEPSS 0.3%CVE-2025-23811HIGHWordPress WP2APP Plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36819MEDIUMMAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payloEPSS 0.3%CVE-2025-23867HIGHWordPress WordPress File Search Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-7932HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-36232MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-41724HIGHVMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)EPSS 0.3%CVE-2024-2458MEDIUMPowerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-103482MEDIUMSimple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key PivotEPSS 0.3%CVE-2026-52606MEDIUMA reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in thEPSS 0.3%