Falhas do tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-33978MEDIUMNotesnook: Stored XSS in mobile share editor via unescaped web clip title metadataEPSS 0.3%CVE-2025-13676MEDIUMJustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELFEPSS 0.3%CVE-2025-22758MEDIUMWordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-62183MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.EPSS 0.3%CVE-2022-3895MEDIUMPotential XSS in common user interface component libraryEPSS 0.3%CVE-2024-39124MEDIUMIn Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.EPSS 0.3%CVE-2025-11804MEDIUMJB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24542MEDIUMWordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-47324MEDIUMStored XSS in Multiple Points in ProjectsAndPrograms school-management-systemEPSS 0.3%CVE-2026-6427MEDIUMa3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ElementEPSS 0.3%CVE-2025-13892MEDIUMMG AdvancedOptions <= 1.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-0448MEDIUMInappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a cEPSS 0.3%CVE-2025-22329MEDIUMWordPress Free Google Maps plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25392MEDIUMSmoothwall Express 3.1 'iptools.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2023-47527MEDIUMWordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2015-20114MEDIUMRealtyScript 4.0.2 Cross-Site Scripting via Multiple ParametersEPSS 0.3%CVE-2026-105972HIGHWooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation AttributeEPSS 0.3%CVE-2024-3492MEDIUMEvents Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category ShortcodesEPSS 0.3%CVE-2026-5625MEDIUMassafelovic gpt-researcher WebSocket researcher.py cross site scriptingEPSS 0.3%CVE-2025-3100MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%