Falhas do tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-7408MEDIUMSourceCodester Zoo Management System animal_form_template.php cross site scriptingEPSS 0.3%CVE-2024-38953MEDIUMphpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.EPSS 0.3%CVE-2024-51668MEDIUMWordPress MyCurator Content Curation plugin <= 3.78 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2078MEDIUMCross-Site Scripting vulnerability in HelpDeskZEPSS 0.3%CVE-2024-53786MEDIUMWordPress Cowidgets – Elementor Addons plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4667MEDIUMSimply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-28983HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.3%CVE-2025-63708MEDIUMCross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to exEPSS 0.3%CVE-2024-2211MEDIUMCross-Site Scripting vulnerability in Gophish Admin PanelEPSS 0.3%CVE-2025-1571MEDIUMExclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison WidgetsEPSS 0.3%CVE-2025-57540MEDIUMA stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox EPSS 0.3%CVE-2024-6261MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7857MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scriptingEPSS 0.3%CVE-2024-31159MEDIUMASUS Download Master - Reflected XSSEPSS 0.3%CVE-2024-8328MEDIUMHWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSSEPSS 0.3%CVE-2025-2477MEDIUMCryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' ParameterEPSS 0.3%CVE-2026-5090MEDIUMTemplate::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injectedEPSS 0.3%CVE-2025-57539MEDIUMA stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVEPSS 0.3%CVE-2024-37156MEDIUMTokenController formName not sanitized in hidden inputEPSS 0.3%