Falhas do tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-2861MEDIUMProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel WidgetEPSS 0.3%CVE-2025-23748HIGHWordPress Singsys -Awesome Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41846MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47094MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-13015MEDIUMPHPGurukul Maid Hiring Management System search-booking-request.php cross site scriptingEPSS 0.3%CVE-2025-26993HIGHWordPress Visual Website Collaboration Atarim plugin <= 4.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14385MEDIUMWP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-38781HIGHWordPress CopySafe Web Protection plugin <= 3.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23525HIGHWordPress Kv Compose Email From Dashboard plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43276HIGHWordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22564HIGHWordPress Pretty Url Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-62654LOWStored XSS through system messages in QuizGameEPSS 0.3%CVE-2023-27739MEDIUMeasyXDM 2.5 allows XSS via the xdm_e parameter.EPSS 0.3%CVE-2024-33983HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2024-41847MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-33988HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2023-7238HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web ViewerEPSS 0.3%CVE-2024-13379MEDIUMC9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-13563MEDIUMFront End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password ShortcodeEPSS 0.3%CVE-2024-13583MEDIUMSimple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%