Falhas do tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-1916—Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-ScriptingEPSS 1.9%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.9%CVE-2022-0271—LearnPress < 4.1.6 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2023-0214MEDIUMXSS in Skyhigh Security SWGEPSS 1.9%CVE-2022-1756—Newsletter < 7.4.5 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2021-24987—Super Socializer < 7.13.30 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2020-26218HIGHHTML Injection in touchbase.aiEPSS 1.9%CVE-2019-17634—Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report frEPSS 1.9%CVE-2023-29848MEDIUMBang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php EPSS 1.9%CVE-2019-1010091—tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code eEPSS 1.9%CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2020-4054HIGHCross-site Scripting in SanitizeEPSS 1.9%CVE-2020-24416HIGHBlind stored XSS in Marketo Sales insight plugin for SalesForceEPSS 1.9%CVE-2024-27314LOWStored XSS VulnerabilityEPSS 1.9%CVE-2026-48294HIGHAdobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. EPSS 1.9%CVE-2019-17632—In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conteEPSS 1.9%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2018-16471—There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `schemEPSS 1.9%CVE-2023-4973LOWAcademy LMS GET Parameter filter cross site scriptingEPSS 1.9%CVE-2021-22886—Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a rEPSS 1.9%