Falhas do tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-46859MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-47226MEDIUMA stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel viaEPSS 0.3%CVE-2024-2727MEDIUMStored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemEPSS 0.3%CVE-2025-3750MEDIUMNetwork Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height ParameterEPSS 0.3%CVE-2025-46860MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-60507HIGHCross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF coEPSS 0.3%CVE-2024-51889MEDIUMWordPress Fancy User List plugin <= 3.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-22674MEDIUMHashgraph Guardian Stored XSS via branding companyName fieldEPSS 0.3%CVE-2025-46851MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47828MEDIUMLumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.EPSS 0.3%CVE-2024-51868MEDIUMWordPress DuoGeek Blocks plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51910MEDIUMWordPress Assist24 Help Desk plugin <= 20150401.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7066MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauEPSS 0.3%CVE-2023-52084LOWWinter CMS Stored XSS through Backend ColorPicker FormWidgetEPSS 0.3%CVE-2024-51909MEDIUMWordPress audioCase plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2179LOWConcrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group typeEPSS 0.3%CVE-2026-0867MEDIUMEssential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-25854MEDIUMCross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the SuEPSS 0.3%CVE-2024-30425MEDIUMWordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48244MEDIUMWordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%