Falhas do tipo CWE-79

28.667 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-40785MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, mEPSS 0.8%CVE-2024-40511HIGHCross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmiEPSS 0.8%CVE-2025-34032MEDIUMMoodle LMS Jmol Plugin Cross-site Scripting (XSS)EPSS 0.8%CVE-2020-7015—Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVEPSS 0.8%CVE-2022-3223MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.8%CVE-2021-4358HIGHWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-23552HIGHGrafana stored XSS in FileUploader component EPSS 0.8%CVE-2024-44779HIGHA reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to exeEPSS 0.8%CVE-2023-47777MEDIUMWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2019-3747HIGHDell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious EPSS 0.8%CVE-2025-61623MEDIUMApache OFBiz: Reflected Cross-site ScriptingEPSS 0.8%CVE-2023-28836MEDIUMWagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewsEPSS 0.8%CVE-2017-9276MEDIUMXSS Vulnerability in iManagerEPSS 0.8%CVE-2020-10776—A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allEPSS 0.8%CVE-2022-46165MEDIUMCross-site Scripting (XSS) in Web GUI in syncthingEPSS 0.8%CVE-2026-0594MEDIUMList Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphaEPSS 0.8%CVE-2022-1445CRITICALStored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-itEPSS 0.8%CVE-2024-11381MEDIUMControl horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2020-29029HIGHXSS issue due to insufficient sanitization of input fieldEPSS 0.8%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%