Falhas do tipo CWE-79

28.989 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-0806MEDIUMcode-projects Job Recruitment _call_job_search_ajax.php cross site scriptingEPSS 0.6%CVE-2016-2138—In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.EPSS 0.6%CVE-2023-47125MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.6%CVE-2024-4075LOWKashipara Online Furniture Shopping Ecommerce Website login.php cross site scriptingEPSS 0.6%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.6%CVE-2023-0446MEDIUMMy YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5013LOWPluck CMS Installation install.php cross site scriptingEPSS 0.6%CVE-2022-2213LOWSourceCodester Library Management System cross site scriptingEPSS 0.6%CVE-2022-1817LOWBadminton Center Management System Userlist Module cross site scriptingEPSS 0.6%CVE-2024-23604MEDIUMCross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrarEPSS 0.6%CVE-2024-22780MEDIUMCross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the eEPSS 0.6%CVE-2024-10761MEDIUMUmbraco CMS Dashboard frame cross site scriptingEPSS 0.6%CVE-2023-3183LOWSourceCodester Performance Indicator System addproduct.php cross site scriptingEPSS 0.6%CVE-2023-50717MEDIUMNocoDB Allows Preview of File with Dangerous ContentEPSS 0.6%CVE-2023-49983MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execEPSS 0.6%CVE-2025-7887MEDIUMZavy86 WikiDocs template.inc.php cross site scriptingEPSS 0.6%CVE-2023-49539MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category. This EPSS 0.6%CVE-2024-1535MEDIUMProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2026-42509MEDIUMApache Wicket: crafted strings can break out of the JavaScript sequenceEPSS 0.6%CVE-2024-48761HIGHReflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erEPSS 0.6%