Falhas do tipo CWE-79

30.293 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-4026MEDIUMCross-Site Scripting in the Holded applicationEPSS 0.3%CVE-2026-66029MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Client Name FieldEPSS 0.3%CVE-2025-70515MEDIUMThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The laEPSS 0.3%CVE-2025-41085MEDIUMStored Cross-Site Scripting (XSS) in Apidog web platformEPSS 0.3%CVE-2026-97030MEDIUMRecognize yield as regexp preceder keyword in html/templateEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2025-8337MEDIUMcode-projects Simple Car Rental System add_vehicles.php cross site scriptingEPSS 0.3%CVE-2024-56265HIGHWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5539MEDIUMcode-projects Simple Laundry System Parameter modifymember.php cross site scriptingEPSS 0.3%CVE-2024-32576MEDIUMWordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63420MEDIUMCrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling peEPSS 0.3%CVE-2024-22876MEDIUMStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which EPSS 0.3%CVE-2024-39125MEDIUMRoundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.EPSS 0.3%CVE-2024-36238MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2023-42427MEDIUMCross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker EPSS 0.3%CVE-2023-52045MEDIUMStudio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.EPSS 0.3%CVE-2026-1316HIGHCustomer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href ParameterEPSS 0.3%CVE-2026-100148MEDIUMRich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)EPSS 0.3%CVE-2025-41065MEDIUMStored Cross-Site Scripting (XSS) in LUNA from Luna ImagingEPSS 0.3%