Falhas do tipo CWE-79

28.491 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-29439HIGHWordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)EPSS 1.7%CVE-2020-15275HIGHmalicious SVG attachment causing stored XSS vulnerability in MoinMoinEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2017-14850MEDIUMAll known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to imEPSS 1.7%CVE-2020-8238—A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to cEPSS 1.7%CVE-2021-38346HIGHBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path TraversalEPSS 1.7%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2024-41937MEDIUMApache Airflow: Stored XSS Vulnerability on provider linkEPSS 1.7%CVE-2018-0118—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2020-7006—Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerabilitEPSS 1.7%CVE-2021-24409—Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2025-25062MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text contentEPSS 1.7%CVE-2023-29506MEDIUMorg.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsEPSS 1.7%CVE-2022-0150—WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2022-0248—Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSSEPSS 1.7%CVE-2022-24891MEDIUMCross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration fileEPSS 1.7%CVE-2018-0223—A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attEPSS 1.7%CVE-2018-0212—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2017-12248—A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to cEPSS 1.7%CVE-2018-0219—A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remotEPSS 1.7%