Falhas do tipo CWE-79

29.079 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-3691LOWlayui HTML Attribute cross site scriptingEPSS 0.5%CVE-2024-24156MEDIUMCross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackeEPSS 0.5%CVE-2024-36194MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-23026MEDIUMCross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary codeEPSS 0.5%CVE-2022-25978MEDIUMAll versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on exteEPSS 0.5%CVE-2023-3026MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.5%CVE-2022-4837MEDIUMCPO Companion < 1.1.0 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2024-36192MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2021-24660—PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2025-1337MEDIUMEastnets PaymentSafe BIC Search cross site scriptingEPSS 0.5%CVE-2024-36189MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-36191MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-10217CRITICALTIBCO Hawk Stored-XSS VulnerabilityEPSS 0.5%CVE-2026-45368HIGHKirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontendEPSS 0.5%CVE-2024-44080HIGHIn Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loadEPSS 0.5%CVE-2026-26862HIGHCleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual BuilEPSS 0.5%CVE-2022-4699MEDIUMMediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2023-0419—Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2024-36249HIGHCross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this EPSS 0.5%CVE-2024-25865MEDIUMCross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia seEPSS 0.5%