Falhas do tipo CWE-79

28.492 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2018-0219—A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remotEPSS 1.7%CVE-2018-0212—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2020-1101MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1099MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1100MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2022-0020MEDIUMCortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web InterfaceEPSS 1.7%CVE-2020-8477HIGHABB System 800xA Information Manager Remote Code ExecutionEPSS 1.7%CVE-2025-8191MEDIUMmacrozheng mall Swagger UI index.html cross site scriptingEPSS 1.7%CVE-2021-36026MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.7%CVE-2021-3509—A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStoEPSS 1.7%CVE-2021-22886—Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a rEPSS 1.7%CVE-2019-16780MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.7%CVE-2022-35493MEDIUMA Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store WebEPSS 1.7%CVE-2020-26296HIGHXSS in VegaEPSS 1.7%CVE-2025-48700MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the ZiEPSS 1.7%KEVCVE-2021-4285LOWNagios NCPA tail.html cross site scriptingEPSS 1.7%CVE-2021-24319—Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSEPSS 1.7%CVE-2020-9737MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2020-9738MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2022-1933—CDI < 5.1.9 - Reflected Cross-Site-ScriptingEPSS 1.7%