Falhas do tipo CWE-79

28.833 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-2671LOWSourceCodester Lost and Found Information System Contact Form cross site scriptingEPSS 0.6%CVE-2019-15968MEDIUMCisco Unified Communications Domain Manager Persistent Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-22117MEDIUMDirectus - Stored Cross-Site Scripting (XSS) in Profile Avatar ImageEPSS 0.6%CVE-2019-16008MEDIUMCisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2020-3233MEDIUMCisco IOx Application Framework Local Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2023-35157HIGHXWiki Platform vulnerable to reflected cross-site scripting via delattachment actionEPSS 0.6%CVE-2022-39172MEDIUMA stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, lowEPSS 0.6%CVE-2020-3320MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2021-24421—WP JobSearch < 1.7.4 - Authenticated Stored XSSEPSS 0.6%CVE-2019-12702MEDIUMCisco SPA100 Series Analog Telephone Adapters Reflected Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2026-66418CRITICALOpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username FieldEPSS 0.6%CVE-2015-10078LOWatwellpub Resend Welcome Email Plugin resend-welcome-email.php send_welcome_email_url cross site scriptingEPSS 0.6%CVE-2022-22116MEDIUMDirectus - Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.6%CVE-2026-66421HIGHOpenClaw Dashboard Stored XSS via lastMessage Session FieldEPSS 0.6%CVE-2020-3157MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2019-12637MEDIUMCisco Identity Services Engine Multiple Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2016-15027LOWmeta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scriptingEPSS 0.6%CVE-2019-12638MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-31857MEDIUMForminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain uEPSS 0.6%CVE-2022-43556MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dasEPSS 0.6%