Falhas do tipo CWE-79

28.979 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-40846MEDIUMIn Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execEPSS 0.6%CVE-2023-0829HIGHCross-Site Scripting (XSS) vulnerability in PleskEPSS 0.6%CVE-2024-42898MEDIUMA cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pEPSS 0.6%CVE-2024-2935MEDIUMSourceCodester Todo List in Kanban Board Add ToDo cross site scriptingEPSS 0.6%CVE-2022-1028—WordPress Security < 4.2.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-36872MEDIUMWordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36870MEDIUMWordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilitiesEPSS 0.6%CVE-2023-25292MEDIUMReflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain seEPSS 0.6%CVE-2025-25427HIGHXSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp pageEPSS 0.6%CVE-2022-38189MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-23656MEDIUMCross-site scripting vulnerability in Zulip ServerEPSS 0.6%CVE-2025-29049MEDIUMCross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitraryEPSS 0.6%CVE-2022-40672MEDIUMWordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-1700MEDIUMkeerti1924 PHP-MYSQL-User-Login-System signup.php cross site scriptingEPSS 0.6%CVE-2023-26123MEDIUMVersions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notEPSS 0.6%CVE-2021-32855MEDIUMvditor vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2021-41095MEDIUMXSS via blocked watched word in error messageEPSS 0.6%CVE-2021-32860MEDIUMiziModal vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2026-0561MEDIUMShield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' ParameterEPSS 0.6%CVE-2022-40195MEDIUMWordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%