Falhas do tipo CWE-79

28.807 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-61492LOWIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibleEPSS 0.7%CVE-2023-5660MEDIUMSendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2024-10385HIGHStored XSS in DirectAdmin Evo SkinEPSS 0.7%CVE-2021-4103MEDIUMCross-site Scripting (XSS) - Stored in vanessa219/vditorEPSS 0.7%CVE-2022-31063MEDIUMCross site scripting via the title of a document in TuleapEPSS 0.7%CVE-2022-40358MEDIUMAn issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.EPSS 0.7%CVE-2021-24267—All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-29839MEDIUMA Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution ofEPSS 0.7%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.7%CVE-2024-29504HIGHCross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloaEPSS 0.7%CVE-2024-35694HIGHWordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2021-24260—Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2389LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-30304MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.EPSS 0.7%CVE-2021-24261—HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSSEPSS 0.7%CVE-2024-40484MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, whiEPSS 0.7%CVE-2021-24263—PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2383LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-2390LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-3148MEDIUMCross-site Scripting (XSS) - Generic in jgraph/drawioEPSS 0.7%