Falhas do tipo CWE-79

28.942 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-28367MEDIUMCross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated aEPSS 0.6%CVE-2023-27923MEDIUMCross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a reEPSS 0.6%CVE-2023-2220LOWDream Technology mica Form Object cross site scriptingEPSS 0.6%CVE-2023-4145MEDIUMCross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkEPSS 0.6%CVE-2022-20802MEDIUMCisco Enterprise Chat and Email Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-2371—YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-6313LOWSourceCodester URL Shortener Long URL cross site scriptingEPSS 0.6%CVE-2025-28074MEDIUMphpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitEPSS 0.6%CVE-2026-28223MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfaceEPSS 0.6%CVE-2017-7438MEDIUMDOM cross site scripting attack against NetIQ Privileged Account ManagerEPSS 0.6%CVE-2024-52793MEDIUMXSS vulnerability in serveDir API of @std/http/file-server on POSIX systemsEPSS 0.6%CVE-2023-3143LOWSourceCodester Online Discussion Forum Site manage_post.php cross site scriptingEPSS 0.6%CVE-2026-28222MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributesEPSS 0.6%CVE-2022-2391—Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-28073MEDIUMphpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitraryEPSS 0.6%CVE-2026-65767HIGHMicrosoft Teams for Android Spoofing VulnerabilityEPSS 0.6%CVE-2022-2299—Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVGEPSS 0.6%CVE-2023-2516MEDIUMCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.6%CVE-2023-1374MEDIUMSolidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2015MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 befoEPSS 0.6%