Falhas do tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-61313HIGHA reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of GmbH Mecury Managed Print Services (docuFoEPSS 0.3%CVE-2021-34582MEDIUMPhoenix Contact: FL MGUARD XSS through web-based management and REST APIEPSS 0.3%CVE-2025-1690MEDIUMThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-12308MEDIUMLogo Slider < 4.6.0 - Contributor+ Stored XSSEPSS 0.3%CVE-2025-26528LOWStored XSS in ddimageortext question typeEPSS 0.3%CVE-2025-1405MEDIUMProduct Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products ShortcodeEPSS 0.3%CVE-2025-7942MEDIUMPHPGurukul Taxi Stand Management System admin-profile.php cross site scriptingEPSS 0.3%CVE-2025-61311HIGHA reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1EPSS 0.3%CVE-2025-63441HIGHOpen Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frienEPSS 0.3%CVE-2024-39174MEDIUMA cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts EPSS 0.3%CVE-2025-14701HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerEPSS 0.3%CVE-2024-45400MEDIUMCKEditor Open Link plugin vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-90438HIGHNinja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field SubmissionEPSS 0.3%CVE-2025-61314HIGHA reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH Mecury Managed Print Services (docuForm) EPSS 0.3%CVE-2026-1421MEDIUMcode-projects Online Examination System Add Pages cross site scriptingEPSS 0.3%CVE-2026-109999HIGHAI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' ParameterEPSS 0.3%CVE-2025-5285MEDIUMProduct Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag ParameterEPSS 0.3%CVE-2025-4943MEDIUMLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link ParameterEPSS 0.3%CVE-2025-67349MEDIUMA cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" EPSS 0.3%CVE-2026-22919LOWAn attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attEPSS 0.3%