Falhas do tipo CWE-79

28.833 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-38145MEDIUMSilverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's metaEPSS 0.6%CVE-2023-40577HIGHAlertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointEPSS 0.6%CVE-2020-8280—A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scriptiEPSS 0.6%CVE-2021-34625MEDIUMWP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0159HIGHCross-site Scripting (XSS) - Stored in orchardcms/orchardcoreEPSS 0.6%CVE-2023-28332—Moodle: algebra filter xss when filter is misconfiguredEPSS 0.6%CVE-2022-1980LOWSourceCodester Product Show Room Site cross site scriptingEPSS 0.6%CVE-2024-29644MEDIUMCross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script EPSS 0.6%CVE-2022-36347MEDIUMWordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-21325MEDIUMStored XSS in budget typeEPSS 0.6%CVE-2021-4132HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2021-3043HIGHPrisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web ConsoleEPSS 0.6%CVE-2022-3000MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-46332CRITICALProofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"EPSS 0.6%CVE-2026-84108HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%CVE-2022-4698MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form SettingsEPSS 0.6%CVE-2022-3005MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-3004MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-0387MEDIUMCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2024-0345MEDIUMCodeAstro Vehicle Booking System User Registration usr-register.php cross site scriptingEPSS 0.6%