Falhas do tipo CWE-79

28.988 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-3768MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2025-66481CRITICALDeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentEPSS 0.6%CVE-2025-22465MEDIUMReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execEPSS 0.6%CVE-2026-62948CRITICALOpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIEPSS 0.6%CVE-2019-25144MEDIUMWP HTML Mail < 2.2.11 - HTML injectionEPSS 0.6%CVE-2026-13424HIGHOnline Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX actionEPSS 0.6%CVE-2022-20629MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2022-20741MEDIUMCisco Secure Network Analytics Network Diagrams Application Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-48150MEDIUMShopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.EPSS 0.6%CVE-2022-4692HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-20627MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2021-3767MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2021-4372MEDIUMWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-26210HIGHDeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTEPSS 0.6%CVE-2023-33962MEDIUMJStachio XSS vulnerability: Unescaped single quotesEPSS 0.6%CVE-2023-27130MEDIUMCross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied UEPSS 0.6%CVE-2014-125035LOWJobs-Plugin cross site scriptingEPSS 0.6%CVE-2022-38198MEDIUMBUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.6%CVE-2024-25868MEDIUMA Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrEPSS 0.6%CVE-2024-8604MEDIUMSourceCodester Online Food Ordering System Create an Account Page index.php cross site scriptingEPSS 0.6%