Falhas do tipo CWE-79

30.260 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-31395MEDIUMCross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to VeEPSS 0.3%CVE-2026-112951MEDIUMApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixEPSS 0.3%CVE-2025-22315MEDIUMWordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2355MEDIUMMy Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-36450MEDIUMCross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitraryEPSS 0.3%CVE-2026-13083MEDIUMPen-drive: pen-drive: stored xss via unescaped cluster data in html reportEPSS 0.3%CVE-2025-54859MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2026-0751MEDIUMPayment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' ParameterEPSS 0.3%CVE-2025-14984MEDIUMGutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%CVE-2026-63156MEDIUMOmnispace Agora Project < 26.10.0 Reflected XSS via visioUrl ParameterEPSS 0.3%CVE-2025-21603MEDIUMCross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product aEPSS 0.3%CVE-2025-47053MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-51900MEDIUMWordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11332MEDIUMCmsEasy URL view.php cross site scriptingEPSS 0.3%CVE-2025-10367MEDIUMMiczFlor RPi-Jukebox-RFID cardEdit.php cross site scriptingEPSS 0.3%CVE-2024-1219MEDIUMEasy Social Feed < 6.5.6 - Contributor+ Stored XSSEPSS 0.3%CVE-2023-50834MEDIUMWordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2022-3025MEDIUMBitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRFEPSS 0.3%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%