Falhas do tipo CWE-79

28.488 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2018-5405—The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.EPSS 3.7%CVE-2021-24387—Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)EPSS 3.7%CVE-2025-34178MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site ScriptingEPSS 3.7%CVE-2026-3228MEDIUMNextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' ShortcodeEPSS 3.7%CVE-2025-69231HIGHOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege EscalationEPSS 3.6%CVE-2025-20303MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker EPSS 3.6%CVE-2022-0901—Ad Inserter < 2.7.12 - Reflected Cross-Site ScriptingEPSS 3.6%CVE-2024-28090MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 3.6%CVE-2021-24498—Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 3.5%CVE-2022-1163MEDIUMCross-site Scripting (XSS) - Stored in mineweb/minewebcmsEPSS 3.5%CVE-2021-24298—Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 3.5%CVE-2021-22872—Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivEPSS 3.4%CVE-2018-6341MEDIUMReact applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That EPSS 3.4%CVE-2024-33113MEDIUMD-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.EPSS 3.4%CVE-2022-0201—Permalink Manager < 2.2.15 - Reflected Cross-Site ScriptingEPSS 3.4%CVE-2021-24495—Marmoset Viewer < 1.9.3 - Reflected Cross Site ScriptingEPSS 3.3%CVE-2021-21043MEDIUMReflected Cross-site Scripting (XSS) on version-compare and page-compare toolsEPSS 3.3%CVE-2023-2822MEDIUMEllucian Ethos Identity logout cross site scriptingEPSS 3.3%CVE-2021-37859HIGHReflected XSS in OAuth FlowEPSS 3.3%CVE-2022-0967MEDIUMStored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdocEPSS 3.3%