Falhas do tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-13734MEDIUMCard Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card WidgetEPSS 0.3%CVE-2025-61312HIGHA reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) vEPSS 0.3%CVE-2026-23630MEDIUMDocmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingEPSS 0.3%CVE-2022-36417MEDIUMWordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2023-52069MEDIUMkodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.EPSS 0.3%CVE-2023-6672MEDIUMStored XSS in National Keep's CyberMathEPSS 0.3%CVE-2025-1689MEDIUMThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-4405MEDIUMHot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%CVE-2026-109960HIGHFroxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme ValueEPSS 0.3%CVE-2026-100196HIGHLazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2024-51664MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23169MEDIUMThe web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule cEPSS 0.3%CVE-2024-31160MEDIUMASUS Download Master - Stored XSSEPSS 0.3%CVE-2024-37521MEDIUMWordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-109288HIGHOpen WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown LinksEPSS 0.3%CVE-2026-30830LOWDefuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagEPSS 0.3%CVE-2024-46077MEDIUMitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-usEPSS 0.3%CVE-2026-0742MEDIUMSmart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX ActionEPSS 0.3%CVE-2025-50859MEDIUMReflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackersEPSS 0.3%CVE-2025-7791MEDIUMPHPGurukul Online Security Guards Hiring System search.php cross site scriptingEPSS 0.3%