Falhas do tipo CWE-79

30.271 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-28045MEDIUMDelta Electronics DIAEnergie Cross-site scriptingEPSS 0.3%CVE-2026-114718MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error texEPSS 0.3%CVE-2025-39397HIGHWordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32506HIGHWordPress AT Internet SmartTag plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23858HIGHWordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32602HIGHWordPress WooMS Plugin <= 9.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49300HIGHWordPress Hero Menu plugin <= 1.16.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12214MEDIUMWooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink ParameterEPSS 0.3%CVE-2025-32515HIGHWordPress Terminal Africa plugin <= 1.13.24 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27324HIGHWordPress 17TRACK for WooCommerce Plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24619HIGHWordPress WP Log Action Plugin <= 0.51 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22558MEDIUMWordPress mcjh button shortcode plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-28034MEDIUMCross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user EPSS 0.3%CVE-2025-3862MEDIUMContest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-32592HIGHWordPress TableOn Plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9174MEDIUMStored HTML Injection in Hubshare social moduleEPSS 0.3%CVE-2025-42620HIGHCSRF vulnerability in CIRCL Vulnerability-LookupEPSS 0.3%CVE-2025-24745HIGHWordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34932HIGHhoppscotch: Stored XSS via mock server responses on backend originEPSS 0.3%CVE-2025-39521HIGHWordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%