Falhas do tipo CWE-79

29.170 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-47917HIGHMobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.5%CVE-2022-3193MEDIUMAn HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails toEPSS 0.5%CVE-2025-51990MEDIUMXWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specEPSS 0.5%CVE-2023-0107MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.5%CVE-2026-26723HIGHCross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to executeEPSS 0.5%CVE-2024-22238MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject maEPSS 0.5%CVE-2017-5256—In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System DeEPSS 0.5%CVE-2023-0949MEDIUMCross-site Scripting (XSS) - Reflected in modoboa/modoboaEPSS 0.5%CVE-2024-51486MEDIUMStored Cross-Site Scripting in AmpacheEPSS 0.5%CVE-2023-0111MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.5%CVE-2024-40631HIGHCross-site Scripting (XSS) in media embed element when using custom URL parsers in plate mediaEPSS 0.5%CVE-2023-49276MEDIUMAttribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumaEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2024-0422LOWCodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scriptingEPSS 0.5%CVE-2023-2615MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.5%CVE-2026-12811MEDIUMkortix-ai suna Auth Endpoint page.tsx router.push cross site scriptingEPSS 0.5%CVE-2025-0957HIGHVulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email LogsEPSS 0.5%CVE-2022-46622MEDIUMA cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via aEPSS 0.5%CVE-2025-27088HIGHReflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxyEPSS 0.5%CVE-2024-0424LOWCodeAstro Simple Banking System Create a User Page createuser.php cross site scriptingEPSS 0.5%