Falhas do tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-20183—It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of searchEPSS 0.8%CVE-2026-92985HIGHSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsEPSS 0.8%CVE-2026-92986HIGHSiYuan before 3.8.4 Cross-Site Scripting via Document TitleEPSS 0.8%CVE-2021-31851MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2022-3144MEDIUMWordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2024-27914MEDIUMReflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPIEPSS 0.8%CVE-2023-23921—Moodle: reflected xss risk in some returnurl parametersEPSS 0.8%CVE-2024-52770CRITICALAn arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary cEPSS 0.8%CVE-2022-2092—WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-56156MEDIUMHalo Vulnerable to Stored XSS and RCE via File Upload BypassEPSS 0.8%CVE-2022-0253HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.8%CVE-2021-1395MEDIUMCisco Unified Intelligence Center Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-31852MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2022-25929MEDIUMCross-site Scripting (XSS)EPSS 0.8%CVE-2020-28210MEDIUMA CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building OpeEPSS 0.8%CVE-2024-26521MEDIUMHTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, andEPSS 0.8%CVE-2021-21541MEDIUMDell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker couldEPSS 0.8%CVE-2021-1575MEDIUMCisco Virtualized Voice Browser Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-2022CRITICALCross-site Scripting (XSS) - Stored in nocodb/nocodbEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%