Falhas do tipo CWE-79

29.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-6366HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert CenterEPSS 0.5%CVE-2025-1174MEDIUM1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scriptingEPSS 0.5%CVE-2023-32685MEDIUMClipboard based cross-site scripting (blocked with default CSP) in KanboardEPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%CVE-2026-18481MEDIUMStored XSS in Participant URL Field leads to Account Takeover via Session Token TheftEPSS 0.5%CVE-2023-7315MEDIUMNagios XI < 5.11.3 XSS via Graph ExplorerEPSS 0.5%CVE-2023-6365HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Device GroupsEPSS 0.5%CVE-2024-2779LOWCampcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scriptingEPSS 0.5%CVE-2023-6367HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via RolesEPSS 0.5%CVE-2023-1767MEDIUMThe Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is toEPSS 0.5%CVE-2023-6364HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via DashboardEPSS 0.5%CVE-2023-0314MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.5%CVE-2022-46968MEDIUMA stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbiEPSS 0.5%CVE-2023-23470MEDIUMIBM i privilege escalationEPSS 0.5%CVE-2025-4611MEDIUMSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs ShortcodeEPSS 0.5%CVE-2023-0327LOWsaemorris TheRadSystem users.php cross site scriptingEPSS 0.5%CVE-2022-4822LOWFlatPress Setup main.lib.php cross site scriptingEPSS 0.5%CVE-2022-37339MEDIUMWordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%CVE-2022-4821LOWFlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingEPSS 0.5%