Falhas do tipo CWE-79

30.473 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-4119MEDIUMAcademy LMS courses cross site scriptingEPSS 3.8%CVE-2021-24389—FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)EPSS 3.8%CVE-2020-25627—The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed inEPSS 3.7%CVE-2025-51991HIGHXWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within theEPSS 3.7%CVE-2022-0776MEDIUMCross-site Scripting (XSS) - DOM in hakimel/reveal.jsEPSS 3.7%CVE-2021-24387—Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)EPSS 3.7%CVE-2018-5405—The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.EPSS 3.6%CVE-2022-0901—Ad Inserter < 2.7.12 - Reflected Cross-Site ScriptingEPSS 3.6%CVE-2024-28090MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 3.6%CVE-2026-41456MEDIUMBludit CMS Reflected XSS via Search PluginEPSS 3.5%CVE-2021-24498—Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 3.5%CVE-2022-1163MEDIUMCross-site Scripting (XSS) - Stored in mineweb/minewebcmsEPSS 3.5%CVE-2021-22872—Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivEPSS 3.5%CVE-2021-24298—Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 3.5%CVE-2022-22242MEDIUMJunos OS: Cross-site Scripting (XSS) vulnerability in J-WebEPSS 3.4%CVE-2018-6341MEDIUMReact applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That EPSS 3.4%CVE-2024-33113MEDIUMD-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.EPSS 3.4%CVE-2021-21043MEDIUMReflected Cross-site Scripting (XSS) on version-compare and page-compare toolsEPSS 3.4%CVE-2022-0201—Permalink Manager < 2.2.15 - Reflected Cross-Site ScriptingEPSS 3.4%CVE-2021-24495—Marmoset Viewer < 1.9.3 - Reflected Cross Site ScriptingEPSS 3.3%