Falhas do tipo CWE-79

30.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-2069MEDIUMA cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a loEPSS 0.2%CVE-2025-59757MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64984MEDIUMKaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), KEPSS 0.2%CVE-2025-59773MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-5077MEDIUMTotal <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt AttributeEPSS 0.2%CVE-2025-22491MEDIUMImproper Input Validation in Foreseer Reporting Software (FRS)EPSS 0.2%CVE-2026-2485MEDIUMIBM InfoSphere Information Server Cross-Site ScriptingEPSS 0.2%CVE-2025-40903MEDIUMHTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2025-54862MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%CVE-2025-43761MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2026-5362MEDIUMPimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingEPSS 0.2%CVE-2026-38947MEDIUMFluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.EPSS 0.2%CVE-2025-59768MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64047MEDIUMOpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.EPSS 0.2%CVE-2025-59766MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-60933MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17EPSS 0.2%CVE-2025-43765MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024EPSS 0.2%CVE-2026-93367HIGHVisitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)EPSS 0.2%CVE-2025-59752MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-11860MEDIUMTwitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%