Falhas do tipo CWE-79

28.667 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-0966LOWSourceCodester Online Eyewear Shop cross site scriptingEPSS 0.8%CVE-2026-50551CRITICALSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentEPSS 0.8%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2023-40284HIGHAn issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.EPSS 0.8%CVE-2022-2924HIGHCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.8%CVE-2023-0585MEDIUMAll in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2023-21806HIGHPower BI Report Server Spoofing VulnerabilityEPSS 0.8%CVE-2023-26486MEDIUMVega `scale` expression function cross site scriptingEPSS 0.8%CVE-2026-29859CRITICALAn arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file.EPSS 0.8%CVE-2025-1613MEDIUMFiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross site scriptingEPSS 0.8%CVE-2024-36197MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.8%CVE-2025-1614MEDIUMFiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scriptingEPSS 0.8%CVE-2021-34650MEDIUMeID Easy <= 4.6 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-3033HIGHIf a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>htEPSS 0.8%CVE-2024-36141MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.8%CVE-2020-3553MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2020-3515MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2024-32392MEDIUMCross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.EPSS 0.8%CVE-2021-40115MEDIUMCisco Webex Video Mesh Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-34732MEDIUMCisco Prime Collaboration Provisioning Cross-Site Scripting VulnerabilityEPSS 0.8%