Falhas do tipo CWE-79

28.490 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2019-17634—Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report frEPSS 1.9%CVE-2025-34141MEDIUMETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`EPSS 1.9%CVE-2023-29848MEDIUMBang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php EPSS 1.9%CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2019-1010091—tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code eEPSS 1.9%CVE-2020-24416HIGHBlind stored XSS in Marketo Sales insight plugin for SalesForceEPSS 1.9%CVE-2024-27314LOWStored XSS VulnerabilityEPSS 1.9%CVE-2026-48294HIGHAdobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. EPSS 1.9%CVE-2019-17632—In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conteEPSS 1.9%CVE-2021-24436—W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)EPSS 1.9%CVE-2026-41456MEDIUMBludit CMS Reflected XSS via Search PluginEPSS 1.9%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2018-16471—There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `schemEPSS 1.9%CVE-2023-0214MEDIUMXSS in Skyhigh Security SWGEPSS 1.9%CVE-2023-4973LOWAcademy LMS GET Parameter filter cross site scriptingEPSS 1.9%CVE-2020-9734CRITICALStored XSS in AEM Forms componentEPSS 1.9%CVE-2020-9741CRITICALStored XSS in AEM Forms ComponentsEPSS 1.9%CVE-2020-9740CRITICALStored XSS in AEM Design Importer ComponentEPSS 1.9%CVE-2023-29347HIGHWindows Admin Center Spoofing VulnerabilityEPSS 1.9%CVE-2022-0963MEDIUMUnrestricted XML Files Leads to Stored XSS in microweber/microweberEPSS 1.9%