Falhas do tipo CWE-79

29.250 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-4944MEDIUMAwesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46686MEDIUMJenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom EPSS 0.5%CVE-2023-24192MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.EPSS 0.5%CVE-2026-15715MEDIUMSourceCodester Class and Exam Timetabling System exam.php cross site scriptingEPSS 0.5%CVE-2023-24191MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.phpEPSS 0.5%CVE-2026-14634MEDIUMkirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scriptingEPSS 0.5%CVE-2023-0738MEDIUMOrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the EPSS 0.5%CVE-2023-43342MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.5%CVE-2026-14633MEDIUMkirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scriptingEPSS 0.5%CVE-2024-53635MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing ManageEPSS 0.5%CVE-2023-28849CRITICALGLPI vulnerable to SQL injection and Stored XSS via inventory agent requestEPSS 0.5%CVE-2025-59545CRITICALDNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt moduleEPSS 0.5%CVE-2026-9566MEDIUMteableio teable Sign-up LoginPage.tsx cross site scriptingEPSS 0.5%CVE-2024-1323MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-41599MEDIUMCross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload methodEPSS 0.5%CVE-2023-0624MEDIUMOrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the EPSS 0.5%CVE-2026-82805MEDIUMTypora Mermaid Rendering cross site scriptingEPSS 0.5%CVE-2021-37936MEDIUMIt was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the abEPSS 0.5%CVE-2024-4430MEDIUMBeaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attributeEPSS 0.5%CVE-2023-24195MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.EPSS 0.5%