Falhas do tipo CWE-79

28.942 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-51055MEDIUMAn issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.EPSS 0.6%CVE-2021-24423—UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-1127MEDIUMCisco Enterprise NFV Infrastructure Software Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2018-3763—In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS EPSS 0.6%CVE-2023-23630HIGHCross-site (XSS) vulnerability with Express API in EtaEPSS 0.6%CVE-2022-38439MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2025-4460MEDIUMTOTOLINK N150RT URL Filtering Page cross site scriptingEPSS 0.6%CVE-2023-47795CRITICALStored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DEPSS 0.6%CVE-2023-3888LOWCampcodes Beauty Salon Management System admin-profile.php cross site scriptingEPSS 0.6%CVE-2021-24481—Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24479—DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24448—Profile Builder < 3.4.8 - Authenticated Stored XSSEPSS 0.6%CVE-2022-0372HIGHCross-site Scripting (XSS) - Stored in crater-invoice/craterEPSS 0.6%CVE-2023-4635MEDIUMEventON <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2021-24519—Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2015-9104—Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticatedEPSS 0.6%CVE-2023-27925MEDIUMCross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remoteEPSS 0.6%CVE-2022-2935MEDIUMImage Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URLEPSS 0.6%CVE-2021-24343—iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-1180LOWSourceCodester Health Center Patient Record Management System hematology_print.php cross site scriptingEPSS 0.6%