Falhas do tipo CWE-79

29.071 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-20967MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conEPSS 0.5%CVE-2023-2752HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2022-45028MEDIUMA cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a craftEPSS 0.5%CVE-2025-53484CRITICALSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputEPSS 0.5%CVE-2026-42457CRITICALvCluster Platform: Stored XSS can lead to privilege escalationEPSS 0.5%CVE-2023-5128MEDIUMTCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-0306CRITICALCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2022-35298—SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriptingEPSS 0.5%CVE-2025-46550MEDIUMYeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingEPSS 0.5%CVE-2022-33929MEDIUMDell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated EPSS 0.5%CVE-2026-66396CRITICALSiYuan before v3.7.2 Stored XSS to RCE via title-img IALEPSS 0.5%CVE-2021-36686MEDIUMCross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.EPSS 0.5%CVE-2024-13012MEDIUMcode-projects Hostel Management System registration.php cross site scriptingEPSS 0.5%CVE-2021-36603MEDIUMCross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "FrEPSS 0.5%CVE-2022-4632LOWAuto Upload Images cross site scriptingEPSS 0.5%CVE-2023-5659MEDIUMInteract: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-9548HIGHSlimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2019-25084LOWHide Files on GitHub options.js addEventListener cross site scriptingEPSS 0.5%CVE-2023-5658MEDIUMWP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2020-11064MEDIUMCross-Site Scripting in TYPO3 CMSEPSS 0.5%