Falhas do tipo CWE-79

29.151 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-28806MEDIUMDOM-Based XSS Vulnerability in QTS and QuTS heroEPSS 0.5%CVE-2026-76984MEDIUMApache Wicket: XSS in MetaDataHeaderItem via addTagAttributeEPSS 0.5%CVE-2023-5791LOWSourceCodester Sticky Notes App add-note.php cross site scriptingEPSS 0.5%CVE-2026-85680HIGHUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleEPSS 0.5%CVE-2026-75802MEDIUMApache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabelEPSS 0.5%CVE-2026-76585HIGHCustomer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' ParameterEPSS 0.5%CVE-2023-5581LOWSourceCodester Medicine Tracker System index.php cross site scriptingEPSS 0.5%CVE-2023-5697LOWCodeAstro Internet Banking System pages_withdraw_money.php cross site scriptingEPSS 0.5%CVE-2026-88824HIGHMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label SettingsEPSS 0.5%CVE-2026-78333HIGH12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event LogEPSS 0.5%CVE-2023-5694LOWCodeAstro Internet Banking System pages_system_settings.php cross site scriptingEPSS 0.5%CVE-2026-85122HIGHEasy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type ConfusionEPSS 0.5%CVE-2024-4490MEDIUMElegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-81660HIGHGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio FieldEPSS 0.5%CVE-2023-25241MEDIUMbgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.EPSS 0.5%CVE-2026-87786HIGHDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesEPSS 0.5%CVE-2026-88825HIGHiGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget SettingsEPSS 0.5%CVE-2022-37429MEDIUMSilverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splittiEPSS 0.5%CVE-2023-5698LOWCodeAstro Internet Banking System pages_deposit_money.php cross site scriptingEPSS 0.5%CVE-2024-34091HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%