Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-4173LOWmooSocial mooStore index cross site scriptingEPSS 5.4%CVE-2021-24610—TranslatePress < 2.0.9 - Authenticated Stored Cross-Site ScriptingEPSS 5.4%CVE-2020-27659HIGHMultiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web EPSS 5.2%CVE-2022-41441MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a craftedEPSS 5.2%CVE-2023-45136CRITICALXWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledEPSS 5.1%CVE-2023-29983MEDIUMCross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog EPSS 5.1%CVE-2021-24901—Security Audit <= 1.0.0 - Admin+ Stored Cross Site ScriptingEPSS 5.1%CVE-2021-24904—Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site ScriptingEPSS 5.1%CVE-2025-34301MEDIUMIPFire < v2.29 Stored XSS via Location Group CreationEPSS 5.0%CVE-2025-34309MEDIUMIPFire < v2.29 Stored XSS via Dynamic DNS HostEPSS 5.0%CVE-2021-43810HIGHCross-site Scripting (XSS) when redirect an urlEPSS 5.0%CVE-2021-22510—Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 aEPSS 5.0%CVE-2025-54252MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 4.9%CVE-2022-1001—WP Downgrade < 1.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 4.9%CVE-2025-3994MEDIUMTOTOLINK N150RT IP Port Filtering home.htm cross site scriptingEPSS 4.8%CVE-2022-35653—A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-suppliedEPSS 4.8%CVE-2021-24247—Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)EPSS 4.7%CVE-2020-37153HIGHASTPP VoIP 4.0.1 - Remote Code ExecutionEPSS 4.6%CVE-2022-1022HIGHCross-site Scripting (XSS) - Stored in chatwoot/chatwootEPSS 4.5%CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%