Falhas do tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-34375HIGHAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageEPSS 0.3%CVE-2024-36656MEDIUMIn MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.EPSS 0.3%CVE-2021-47920MEDIUMWebMO Job Manager 20.0 Cross-Site Scripting via Search ParametersEPSS 0.3%CVE-2024-43217HIGHWordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37776MEDIUMA cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.3%CVE-2025-1489MEDIUMWP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox ShortcodeEPSS 0.3%CVE-2026-33348HIGHOpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3EPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%CVE-2024-43126HIGHWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20203MEDIUMA vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coEPSS 0.3%CVE-2024-5406MEDIUMMultiple vulnerabilities in WinNMP from WtripleEPSS 0.3%CVE-2024-43959HIGHWordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46333MEDIUMAn authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a EPSS 0.3%CVE-2025-0706MEDIUMJoeyBling bootplus admin.html cross site scriptingEPSS 0.3%CVE-2024-47333HIGHWordPress Loops & Logic plugin <= 4.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6497MEDIUMWordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-39534HIGHWordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52746HIGHWordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-37003MEDIUMSellacious eCommerce 4.6 - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2025-55175MEDIUMReflected XSS in QuickCMSEPSS 0.3%