Falhas do tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-0858MEDIUMCross-site scripting vulnerability in ePOEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%CVE-2022-20959MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-44897MEDIUMA cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web sEPSS 0.8%CVE-2022-41391CRITICALOcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.EPSS 0.8%CVE-2024-50861MEDIUMThe ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG KeyEPSS 0.8%CVE-2019-1838MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-36416MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2021-4222—WP Paginate < 2.1.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-38467MEDIUMWordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2021-29104MEDIUMThere is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.EPSS 0.8%CVE-2021-25024—Event Calendar < 1.1.51 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-33326MEDIUMA cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to eEPSS 0.8%CVE-2021-24923—Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSSEPSS 0.8%CVE-2017-16774MEDIUMCross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 EPSS 0.8%CVE-2020-5269MEDIUMReflected XSS on AdminFeatures page of PrestaShopEPSS 0.8%CVE-2026-45644HIGHMicrosoft Live Share Canvas SDK Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2021-4170HIGHCross-site Scripting (XSS) - Stored in janeczku/calibre-webEPSS 0.8%CVE-2020-5278MEDIUMReflected XSS on Exception page of PrestaShopEPSS 0.8%CVE-2020-5276MEDIUMReflected XSS on AdminCarts page of PrestaShopEPSS 0.8%