Falhas do tipo CWE-79

29.039 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-2862LOWSiteServer CMS search cross site scriptingEPSS 0.6%CVE-2024-13352HIGHLegull <= 1.2.2 - Reflected XSSEPSS 0.6%CVE-2022-40029MEDIUMSourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newPrEPSS 0.6%CVE-2022-40028MEDIUMSourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newPrEPSS 0.6%CVE-2024-25712MEDIUMhttp-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFilEPSS 0.6%CVE-2023-24651MEDIUMSimple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the reEPSS 0.6%CVE-2024-32472MEDIUMexcalidraw vulnerable to a Stored XSS in excalidraw's web embed componentEPSS 0.6%CVE-2022-4619MEDIUMSidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-4888MEDIUMSimple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2021-31835MEDIUMMcAfee ePO Cross-Site Scripting vulnerabilityEPSS 0.6%CVE-2023-26140MEDIUMVersions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objeEPSS 0.6%CVE-2022-46670HIGHRockwell Automation MicroLogix 1100 & 1400 Vulnerable to Cross-Site Scripting AttackEPSS 0.6%CVE-2022-2396LOWSourceCodester Simple e-Learning System claire_blake cross site scriptingEPSS 0.6%CVE-2024-8605MEDIUMcode-projects Inventory Management Registration Form registration.php cross site scriptingEPSS 0.6%CVE-2026-34571CRITICALCI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account CompromiseEPSS 0.6%CVE-2023-5127MEDIUMWP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2021-3830LOWCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.6%CVE-2024-4525LOWCampcodes Complete Web-Based School Management System student_payment_details4.php cross site scriptingEPSS 0.6%CVE-2024-29271MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obEPSS 0.6%CVE-2024-4527LOWCampcodes Complete Web-Based School Management System student_payment_details2.php cross site scriptingEPSS 0.6%