Falhas do tipo CWE-79

29.115 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-31223HIGHDradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.EPSS 0.5%CVE-2023-43647MEDIUMbaserCMS Cross-site Scripting vulnerability in File upload FeatureEPSS 0.5%CVE-2023-25062MEDIUMWordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2021-25967MEDIUMCKAN - Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.5%CVE-2022-20657MEDIUMCisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2024-0254MEDIUM(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-0010MEDIUMPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect PortalEPSS 0.5%CVE-2024-1237MEDIUMElementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-54158CRITICALSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()EPSS 0.5%CVE-2026-84673HIGHJenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through StaplerEPSS 0.5%CVE-2022-41435MEDIUMOpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /EPSS 0.5%CVE-2019-25093LOWdragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scriptingEPSS 0.5%CVE-2024-6447HIGHFULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan ParameterEPSS 0.5%CVE-2024-1392MEDIUMElementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button WidgetEPSS 0.5%CVE-2022-20631MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2025-3489MEDIUMNababur Simple-User-Management-System register.php cross site scriptingEPSS 0.5%CVE-2024-45962MEDIUMOctober 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the filEPSS 0.5%CVE-2024-12870MEDIUMStored Cross-site Scripting (XSS) in infiniflow/ragflowEPSS 0.5%CVE-2024-3244MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-27870MEDIUMCROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDATEPSS 0.5%