Falhas do tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-13554MEDIUMitsourcecode Online Hotel Management System POST Request controller.php add cross site scriptingEPSS 0.5%CVE-2026-86668MEDIUMaircheng-org iWebShop-5 pic.php uploadFile cross site scriptingEPSS 0.5%CVE-2024-40846HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously EPSS 0.5%CVE-2026-14656MEDIUMcode-projects Assessment Management remove-user.php cross site scriptingEPSS 0.5%CVE-2024-7686MEDIUMSourceCodester Kortex Lite Advocate Office Management System register_case.php cross site scriptingEPSS 0.5%CVE-2026-86278MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scriptingEPSS 0.5%CVE-2026-13567MEDIUMcode-projects Online Music Site POST Request Feedback.php cross site scriptingEPSS 0.5%CVE-2024-2050HIGH CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects EPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2023-28692MEDIUMWordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-15595MEDIUMSourceCodester Class and Exam Timetabling System forsubject.php cross site scriptingEPSS 0.5%CVE-2026-7596MEDIUMnextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingEPSS 0.5%CVE-2026-31833MEDIUMUmbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringEPSS 0.5%CVE-2026-87926MEDIUMRizwan17 inventory-management-system Login Page index.php cross site scriptingEPSS 0.5%CVE-2024-3138LOWfrancoisjacquet RosarioSIS Add Portal Note cross site scriptingEPSS 0.5%CVE-2023-1554MEDIUMQuick Paypal Payments < 5.7.26.4 - Admin+ Stored XSSEPSS 0.5%CVE-2026-84695CRITICALBookStack before 26.05.4 Stored XSS via Drawing UploadEPSS 0.5%CVE-2026-82700MEDIUMcode-projects Online Shopping System Newsletter Subscription offersmail.php cross site scriptingEPSS 0.5%CVE-2022-46823CRITICALA vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatibleEPSS 0.5%CVE-2019-25297MEDIUMPoll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSSEPSS 0.5%