Falhas do tipo CWE-79

30.294 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-47189MEDIUMNetwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user EPSS 0.3%CVE-2025-5198MEDIUMStackrox: xss in stackroxEPSS 0.3%CVE-2025-59467HIGHA Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation EPSS 0.3%CVE-2024-43994MEDIUMWordPress Kahuna theme <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46448HIGHWordPress Document Management System plugin <= 1.24 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46446HIGHWordPress Libro de Reclamaciones plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2019-25396MEDIUMIPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgiEPSS 0.3%CVE-2024-35652HIGHWordPress Event Tickets with Ticket Scanner plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4125MEDIUMWPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-26882MEDIUMWordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-59935MEDIUMGLPI Vulnerable to Unauthenticated Stored XSS on the Inventory pageEPSS 0.3%CVE-2025-47611HIGHWordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37954HIGHWordPress Simple Responsive Slider plugin <= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47618HIGHWordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35697HIGHWordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8617MEDIUMYITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view ShortcodeEPSS 0.3%CVE-2024-49240HIGHWordPress AB Categories Search Widget plugin <= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49606HIGHWordPress Google Map Locations plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49334HIGHWordPress jLayer Parallax Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67316MEDIUMAn issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyEPSS 0.3%