Falhas do tipo CWE-79

29.158 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-3028MEDIUMerzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scriptingEPSS 0.5%CVE-2026-50178HIGHAngular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service ExtensionEPSS 0.5%CVE-2024-36162MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-85385HIGHConcrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone FieldEPSS 0.5%CVE-2023-3464LOWSimplePHPscripts Classified Ads Script URL Parameter preview.php cross site scriptingEPSS 0.5%CVE-2023-22921HIGHA cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authentEPSS 0.5%CVE-2022-44284MEDIUMDinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).EPSS 0.5%CVE-2024-36159MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-0125LOWControl iD Gerencia Web Web Interface cross site scriptingEPSS 0.5%CVE-2022-43707MEDIUMMyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML viaEPSS 0.5%CVE-2023-1614MEDIUMWP Custom Author URL < 1.0.5 - Admin+ Stored XSSEPSS 0.5%CVE-2022-38481MEDIUMAn issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several EPSS 0.5%CVE-2026-37710MEDIUMCross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL EPSS 0.5%CVE-2026-31807MEDIUMSiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSEPSS 0.5%CVE-2024-1585MEDIUMMetform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2021-31830MEDIUMCross site Scripting (XSS) vulnerability in McAfee DBSecEPSS 0.5%CVE-2024-0896MEDIUMBeaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2020-3532MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2026-78849MEDIUMCross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote EPSS 0.5%CVE-2024-2026MEDIUMPassster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector ShortcodeEPSS 0.5%