Falhas do tipo CWE-79

29.250 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-2031MEDIUMLocatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-45036MEDIUMA cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scriptEPSS 0.5%CVE-2024-27719MEDIUMA cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via EPSS 0.5%CVE-2022-46624MEDIUMA cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTMLEPSS 0.5%CVE-2023-3384MEDIUMQuay: stored cross site scriptingEPSS 0.5%CVE-2023-43377MEDIUMA cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrarEPSS 0.5%CVE-2024-22344MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.5%CVE-2025-52360HIGHA Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entEPSS 0.5%CVE-2024-32325LOWTOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderCEPSS 0.5%CVE-2018-25051LOWJmPotato Pomash editor.html cross site scriptingEPSS 0.5%CVE-2021-4378MEDIUMWP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-2274LOWBdtask G-Prescription Gynaecology & OBS Consultation Software Prescription Dashboard Index cross site scriptingEPSS 0.5%CVE-2024-13183MEDIUMOrbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag ParameterEPSS 0.5%CVE-2021-44461MEDIUMCross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control theEPSS 0.5%CVE-2026-3763MEDIUMcode-projects Simple Flight Ticket Booking System showhistory.php cross site scriptingEPSS 0.5%CVE-2025-0555HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2026-7795MEDIUMClick to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode ParameterEPSS 0.5%CVE-2023-0309HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-12998MEDIUMcode-projects Online Car Rental System GET Parameter index.php cross site scriptingEPSS 0.5%CVE-2023-51445MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources APIEPSS 0.5%