Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2010-3243MEDIUMCross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in MicrosoEPSS 15.7%CVE-2025-30292MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 15.5%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2024-47002HIGHA html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can leadEPSS 15.4%CVE-2022-0437MEDIUMCross-site Scripting (XSS) - DOM in karma-runner/karmaEPSS 15.1%CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 14.8%CVE-2024-31444MEDIUMCacti XSS vulnerability in lib/html.php by reading dirty data stored in databaseEPSS 14.7%CVE-2021-24291—Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 14.4%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 14.4%CVE-2021-21800CRITICALCross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user vEPSS 14.1%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 14.1%CVE-2025-50538HIGHFlowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.EPSS 14.0%CVE-2011-1252MEDIUMCross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office ShaEPSS 14.0%CVE-2021-24286—Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)EPSS 13.9%CVE-2019-3810MEDIUMA flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ EPSS 13.9%CVE-2025-52378MEDIUMCross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject JaEPSS 13.9%CVE-2024-45741MEDIUMPersistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseEPSS 13.9%CVE-2024-5410HIGHStored Cross-Site ScriptingEPSS 13.7%CVE-2022-0595—Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSEPSS 13.6%CVE-2007-4040HIGHArgument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers EPSS 13.5%