Falhas do tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-51709HIGHWordPress TeleAdmin plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-116538LOWHtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML AttributesEPSS 0.3%CVE-2024-53821HIGHWordPress Pie Register Premium plugin < 3.8.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-45026MEDIUMWeGIA: Stored XSS in html/atendido/processo_aceitacao.phpEPSS 0.3%CVE-2025-51569MEDIUMA cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_getEPSS 0.3%CVE-2024-51781HIGHWordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51719HIGHWordPress Simplistic SEO plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-37256MEDIUMGrav - Cross-Site Scripting in Admin Plugin Page EditorEPSS 0.3%CVE-2024-51712HIGHWordPress Jigoshop plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13217MEDIUMUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'EPSS 0.3%CVE-2024-56210HIGHWordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5160MEDIUMVersions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper orEPSS 0.3%CVE-2024-52473HIGHWordPress HTML5 Lyrics Karaoke Player plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10676HIGHWordPress Conversion Helper plugin <= 1.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28871MEDIUMWordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47395HIGHWordPress Robokassa payment gateway for Woocommerce plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-44998MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to executEPSS 0.3%CVE-2024-56338MEDIUMIBM Sterling B2B Integrator cross-site scriptingEPSS 0.3%CVE-2025-44181MEDIUMPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname paramEPSS 0.3%CVE-2024-52491MEDIUMWordPress Sticky Social Icons plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%