Falhas do tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-5340MEDIUMMusic Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url ParameterEPSS 0.3%CVE-2025-0805MEDIUMMortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37856MEDIUMCross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, lEPSS 0.3%CVE-2026-26188MEDIUMSolspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations)EPSS 0.3%CVE-2024-0657MEDIUMInternal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-33080HIGHFilament: Unvalidated Range and Values summarizer values can be used for XSSEPSS 0.3%CVE-2024-0703MEDIUMSticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43127HIGHWordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-103418HIGHUniversal XSS via the HTML language attribute in Translation ServicesEPSS 0.3%CVE-2024-6849MEDIUMPreloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-46239MEDIUMMultiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-pEPSS 0.3%CVE-2024-13648MEDIUMMaps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4205MEDIUMPopup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID ParameterEPSS 0.3%CVE-2026-10632HIGHZimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterEPSS 0.3%CVE-2024-11095MEDIUMVisualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-3919MEDIUMWordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-9134MEDIUMPhoto Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode ParameterEPSS 0.3%CVE-2024-13672MEDIUMMini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-0664MEDIUMMeks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-34752HIGHWordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%