Falhas do tipo CWE-79

28.489 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-43523CRITICALIn uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, gEPSS 3.1%CVE-2022-0953—Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site ScriptingEPSS 3.1%CVE-2022-2174MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 3.1%CVE-2022-1597—WPQA < 5.4 - Reflected Cross-Site ScriptingEPSS 3.0%CVE-2023-0827MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 3.0%CVE-2019-6146—It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.EPSS 3.0%CVE-2023-48974CRITICALCross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted scriptEPSS 3.0%CVE-2021-24719—Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)EPSS 3.0%CVE-2022-1192—Turn off all comments <= 1.0 - Reflected Cross-Site ScriptingEPSS 2.9%CVE-2023-32751MEDIUMPydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the AmazonEPSS 2.9%CVE-2022-28222MEDIUMCleanTalk AntiSpam <= 5.173 Reflected XSSEPSS 2.9%CVE-2021-24235—Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSSEPSS 2.9%CVE-2022-2290MEDIUMCross-site Scripting (XSS) - Reflected in zadam/triliumEPSS 2.9%CVE-2021-25120—Easy Social Feed < 6.2.7 - Reflected Cross-Site ScriptingEPSS 2.9%CVE-2023-24278MEDIUMSquidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.EPSS 2.9%CVE-2021-33192—Display information UI XSSEPSS 2.9%CVE-2021-24773—WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site ScriptingEPSS 2.9%CVE-2020-1936—Stored XSS in Apache AmbariEPSS 2.9%CVE-2025-24459MEDIUMIn JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageEPSS 2.8%CVE-2024-35540HIGHA stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 2.8%