Falhas do tipo CWE-79

29.079 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-1337MEDIUMEastnets PaymentSafe BIC Search cross site scriptingEPSS 0.5%CVE-2023-0419—Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2024-36182MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-36201MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-3691LOWlayui HTML Attribute cross site scriptingEPSS 0.5%CVE-2022-42112MEDIUMA Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DEPSS 0.5%CVE-2023-33942MEDIUMCross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and LiferaEPSS 0.5%CVE-2021-3816—Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creatEPSS 0.5%CVE-2024-0423LOWCodeAstro Online Food Ordering System dishes.php cross site scriptingEPSS 0.5%CVE-2023-6461HIGHCross-site Scripting (XSS) - Reflected in viliusle/minipaintEPSS 0.5%CVE-2025-49745MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.5%CVE-2024-9111MEDIUMProduct Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.5%CVE-2021-32859MEDIUMBaremetrics date range picker vulnerable to Cross-site ScriptingEPSS 0.5%CVE-2025-8349MEDIUMCross-Site Scripting (XSS) stored in Tawk Live ChatEPSS 0.5%CVE-2024-29374MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.EPSS 0.5%CVE-2025-6948HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2019-25156LOWdstar2018 Agency search.php cross site scriptingEPSS 0.5%CVE-2022-42114MEDIUMA Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and LiferEPSS 0.5%CVE-2023-0018CRITICALCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)EPSS 0.5%CVE-2023-33944MEDIUMCross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, anEPSS 0.5%