Falhas do tipo CWE-79

28.997 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-31906MEDIUMApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog ParametersEPSS 0.6%CVE-2023-6486MEDIUMSpectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSSEPSS 0.6%CVE-2023-43509MEDIUMUnauthenticated Endpoint Allows Sending Arbitrary OnGuard NotificationsEPSS 0.6%CVE-2023-45360MEDIUMAn issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenEPSS 0.6%CVE-2022-46733MEDIUMCVE-2022-46733EPSS 0.6%CVE-2023-22724MEDIUMglpi contains XSS in RSS Description LinkEPSS 0.6%CVE-2024-28709MEDIUMCross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted scripEPSS 0.6%CVE-2024-2720LOWCampcodes Complete Online DJ Booking System aboutus.php cross site scriptingEPSS 0.6%CVE-2023-3382LOWSourceCodester Game Result Matrix System GET Parameter save-delegates.php cross site scriptingEPSS 0.6%CVE-2024-27083MEDIUMFlask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)EPSS 0.6%CVE-2024-25297MEDIUMCross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive EPSS 0.6%CVE-2023-41048LOWplone.namedfile vulnerable to Stored Cross Site Scripting with SVG imagesEPSS 0.6%CVE-2020-36692MEDIUMA reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScriEPSS 0.6%CVE-2022-4235MEDIUMRushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible EPSS 0.6%CVE-2024-1215LOWSourceCodester CRUD without Page Reload fetch_data.php cross site scriptingEPSS 0.6%CVE-2021-37374MEDIUMCross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the FriendlEPSS 0.6%CVE-2024-0503LOWcode-projects Online FIR System registercomplaint.php cross site scriptingEPSS 0.6%CVE-2024-4513LOWCampcodes Complete Web-Based School Management System timetable_update_form.php cross site scriptingEPSS 0.6%CVE-2022-4736LOWVenganzas del Pasado cross site scriptingEPSS 0.6%CVE-2024-0758MEDIUMMolecularFaces XSSEPSS 0.6%