Falhas do tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-22309MEDIUMWordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8004HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-5699MEDIUMDeveloper Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSSEPSS 0.3%CVE-2026-65914MEDIUMDOMPurify before 3.3.2 Mutation XSS via Re-ContextualizationEPSS 0.3%CVE-2024-7736HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-41381MEDIUMmicroweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.EPSS 0.3%CVE-2025-7767MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php cross site scriptingEPSS 0.3%CVE-2026-115897LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyEPSS 0.3%CVE-2025-30203MEDIUMTuleap allows XSS via the content of RSS feeds in the RSS widgetsEPSS 0.3%CVE-2025-30907MEDIUMWordPress SecuPress Free plugin <= 2.2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39631HIGHWordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22310MEDIUMWordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29109MEDIUMWordPress Shariff Wrapper plugin <= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14990CRITICALIBM DataPower Gateway affected by cross-site scriptingEPSS 0.3%CVE-2025-9753MEDIUMCampcodes Online Hospital Management System Patient Search patient-search.php cross site scriptingEPSS 0.3%CVE-2025-20211MEDIUMCisco BroadWorks Application Delivery Platform Software Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-109207HIGHRSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URLEPSS 0.3%CVE-2024-29865MEDIUMLogpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.EPSS 0.3%CVE-2025-9130MEDIUMUnify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout ShortcodeEPSS 0.3%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%