Falhas do tipo CWE-79

30.260 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-11332MEDIUMCmsEasy URL view.php cross site scriptingEPSS 0.3%CVE-2024-36450MEDIUMCross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitraryEPSS 0.3%CVE-2024-1219MEDIUMEasy Social Feed < 6.5.6 - Contributor+ Stored XSSEPSS 0.3%CVE-2026-0751MEDIUMPayment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' ParameterEPSS 0.3%CVE-2023-50834MEDIUMWordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2022-3025MEDIUMBitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRFEPSS 0.3%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%CVE-2023-52124MEDIUMWordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-47731MEDIUMIBM QRadar Suite Software cross-site scriptingEPSS 0.3%CVE-2026-40472CRITICALHackage package metadata stored XSS vulnerabilityEPSS 0.3%CVE-2025-2576MEDIUMAyyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2022-26324HIGHPossible XSS in iManager URL for access ComponentEPSS 0.3%CVE-2023-6692MEDIUMUltimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metaboxEPSS 0.3%CVE-2025-2573MEDIUMAmazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-7387MEDIUMLana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-47851MEDIUMWordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-3905MEDIUMCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variaEPSS 0.3%CVE-2026-1084MEDIUMCookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings FieldsEPSS 0.3%CVE-2026-7498HIGHStored XSS in Basamak Informatics' DernekWebEPSS 0.3%