Falhas do tipo CWE-79

28.772 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-29183CRITICALSiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionEPSS 0.7%CVE-2024-56289HIGHWordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2023-28106MEDIUMPimcore vulnerable to Cross-site Scripting in UrlSlug Data typeEPSS 0.7%CVE-2023-22456MEDIUMViewVC XSS vulnerability in revision view changed pathsEPSS 0.7%CVE-2025-25247MEDIUMApache Felix Webconsole: XSS in services consoleEPSS 0.7%CVE-2024-28153HIGHJenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in aEPSS 0.7%CVE-2023-6439LOWZenTao PMS cross site scriptingEPSS 0.7%CVE-2022-2199HIGHICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site ScriptingEPSS 0.7%CVE-2022-2904HIGHA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions startEPSS 0.7%CVE-2023-36869MEDIUMAzure DevOps Server Spoofing VulnerabilityEPSS 0.7%CVE-2026-44376MEDIUMCubeCart: Reflected XSS in Store Search BarEPSS 0.7%CVE-2026-33976CRITICALNotesnook vulnerable to RCE via stored XSS in Web Clipper renderingEPSS 0.7%CVE-2019-18273—OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow EPSS 0.7%CVE-2022-24709HIGHCross site scripting in @awsui/components-reactEPSS 0.7%CVE-2024-55040MEDIUMCross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitraryEPSS 0.7%CVE-2023-22438MEDIUMCross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-EPSS 0.7%CVE-2022-4271HIGHCross-site Scripting (XSS) - Reflected in osticket/osticketEPSS 0.7%CVE-2024-38379MEDIUMApache Allura: Stored authenticated XSSEPSS 0.7%CVE-2022-0598—Login with phone number < 1.3.8 - Multiple Admin+ Stored XSSEPSS 0.7%CVE-2024-10709MEDIUMYaDisk Files <= 1.2.5 - Contributor+ Stored XSS via ShortcodeEPSS 0.7%