Falhas do tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-45644HIGHMicrosoft Live Share Canvas SDK Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2020-5278MEDIUMReflected XSS on Exception page of PrestaShopEPSS 0.8%CVE-2025-40726MEDIUMCross-Site Scripting (XSS) reflected in NostoEPSS 0.8%CVE-2020-29497MEDIUMDell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user EPSS 0.8%CVE-2025-40727MEDIUMReflected Cross-Site Scripting (XSS) in Phoenix CMSEPSS 0.8%CVE-2018-11450—A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits theEPSS 0.8%CVE-2021-25969MEDIUMCamaleon CMS - Stored Cross-Site Scripting (XSS) in CommentsEPSS 0.8%CVE-2008-1299MEDIUMCross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote atEPSS 0.8%CVE-2022-25617MEDIUMWordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2023-33731MEDIUMReflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281EPSS 0.8%CVE-2022-43487MEDIUMCross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitEPSS 0.8%CVE-2021-31355HIGHJunos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portalEPSS 0.8%CVE-2021-31373HIGHJunos OS: SRX Series: Persistent XSS vulnerability in J-WebEPSS 0.8%CVE-2021-41258HIGHCross-site scripting (XSS) from image block content in the site frontendEPSS 0.8%CVE-2022-40348MEDIUMCross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allEPSS 0.8%CVE-2022-35229LOWReflected XSS in discovery page of Zabbix FrontendEPSS 0.8%CVE-2023-26487MEDIUMVega has cross-site scripting vulnerability in `lassoAppend` functionEPSS 0.8%CVE-2024-48392MEDIUMOrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lacEPSS 0.8%CVE-2025-4860MEDIUMD-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scriptingEPSS 0.8%CVE-2016-9605MEDIUMA flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the EPSS 0.8%