Falhas do tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-25147CRITICALCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andEPSS 0.6%CVE-2022-38460MEDIUMWordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-22936MEDIUMCross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student InformatioEPSS 0.6%CVE-2024-0283LOWKashipara Food Management System party_details.php cross site scriptingEPSS 0.6%CVE-2024-3140LOWSourceCodester Computer Laboratory Management System cross site scriptingEPSS 0.6%CVE-2022-2934MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URLEPSS 0.6%CVE-2022-45217MEDIUMA cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML EPSS 0.6%CVE-2024-36498MEDIUMStored cross site scriptingEPSS 0.6%CVE-2025-1239MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListEPSS 0.6%CVE-2026-40545MEDIUMReflected XSS in SOPlanningEPSS 0.6%CVE-2026-46594MEDIUMReflected XSS in PHP Poll ScriptEPSS 0.6%CVE-2026-6909MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-2716MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text EditorEPSS 0.6%CVE-2025-70336MEDIUMA Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbiEPSS 0.6%CVE-2026-6956MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-42710MEDIUMNice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerabEPSS 0.6%CVE-2026-11772MEDIUMReflected XSS in DRIMO CMSEPSS 0.6%CVE-2026-9585HIGHUnauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web PortalEPSS 0.6%CVE-2024-9371MEDIUMBranda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-21052MEDIUMCross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of thEPSS 0.6%