Falhas do tipo CWE-79

29.251 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-2391LOWEVE-NG Lab cross site scriptingEPSS 0.5%CVE-2024-7945MEDIUMitsourcecode Laravel Property Management System Notes Page create cross site scriptingEPSS 0.5%CVE-2024-2479LOWMHA Sistemas arMHAzena Cadastro Page cross site scriptingEPSS 0.5%CVE-2022-28612MEDIUMWordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSSEPSS 0.5%CVE-2023-2340MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-6600HIGHOMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site ScriptingEPSS 0.5%CVE-2024-1397MEDIUMHT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTagEPSS 0.5%CVE-2023-3196MEDIUMMultiple vulnerabilities in Canopsis of CapensisEPSS 0.5%CVE-2023-4564MEDIUMMultiple vulnerabilities in Canopsis of CapensisEPSS 0.5%CVE-2023-5638MEDIUMBooster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46128MEDIUMphpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.EPSS 0.5%CVE-2026-16627HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2021-38728MEDIUMSEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.EPSS 0.5%CVE-2024-45123MEDIUMAdobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2025-25187HIGHCross-site Scripting in Goto Anything allows arbitrary code execution in JoplinEPSS 0.5%CVE-2026-31845CRITICALRukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API EndpointEPSS 0.5%CVE-2024-7247MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown WidgetsEPSS 0.5%CVE-2024-7844MEDIUMSourceCodester Online Graduate Tracer System add_acc.php cross site scriptingEPSS 0.5%CVE-2023-51281MEDIUMCross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firEPSS 0.5%CVE-2024-33528MEDIUMA Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with EPSS 0.5%