Falhas do tipo CWE-79

28.677 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.7%CVE-2020-8031MEDIUMobs: Stored XSSEPSS 0.7%CVE-2022-4035HIGHAppointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment FormEPSS 0.7%CVE-2018-6590—CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.EPSS 0.7%CVE-2021-39183HIGHUnsafe inline XSS OwncastEPSS 0.7%CVE-2021-24455—Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2009-10001LOWjianlinwei cool-php-captcha example-form.php cross site scriptingEPSS 0.7%CVE-2017-7538LOWA cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an orEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%CVE-2018-19942—Cross-site Scripting Vulnerability in File StationEPSS 0.7%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-41565MEDIUMTad TadTools - Reflected XSSEPSS 0.7%CVE-2021-24206—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetEPSS 0.7%CVE-2021-21577MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2024-0376MEDIUMPremium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link WidgetEPSS 0.7%CVE-2022-1682CRITICALReflected Xss using url based payload in neorazorx/facturascriptsEPSS 0.7%CVE-2021-24202—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetEPSS 0.7%CVE-2021-21576MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2021-21581MEDIUMDell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this EPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%