Falhas do tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-4860MEDIUMD-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scriptingEPSS 0.8%CVE-2019-16010MEDIUMCisco SD-WAN Solution vManage Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-6296MEDIUMosCommerce Instant Message compare cross site scriptingEPSS 0.8%CVE-2024-40492HIGHCross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.EPSS 0.8%CVE-2021-24883—Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2020-11036HIGHXSS in GLPIEPSS 0.8%CVE-2019-1956MEDIUMCisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-1949MEDIUMCisco Firepower Management Center Persistent Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-34312MEDIUMVirtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplidEPSS 0.8%CVE-2019-15268MEDIUMCisco Firepower Management Center Multiple Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2019-12667MEDIUMCisco IOS XE Software Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-1973MEDIUMCisco Enterprise NFV Infrastructure Software Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2019-12668MEDIUMCisco IOS and IOS XE Software Stored Banner Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2018-8918MEDIUMCross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arEPSS 0.8%CVE-2019-11827MEDIUMCross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to injEPSS 0.8%CVE-2022-23980MEDIUMWordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2022-1351MEDIUMStored XSS in Tooltip in pimcore/pimcoreEPSS 0.8%CVE-2021-3950HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 0.8%CVE-2023-35335HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2026-46518HIGHOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsEPSS 0.8%