Falhas do tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-13557MEDIUMitsourcecode Online Hotel Management System POST Request controller.php add cross site scriptingEPSS 0.5%CVE-2026-82554MEDIUMSourceCodester Queue Management System add_customer.php cross site scriptingEPSS 0.5%CVE-2026-16486MEDIUMSourceCodester Class and Exam Timetabling System BSIS.php cross site scriptingEPSS 0.5%CVE-2026-13554MEDIUMitsourcecode Online Hotel Management System POST Request controller.php add cross site scriptingEPSS 0.5%CVE-2024-42761MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which EPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2026-95396MEDIUMsfturing hosp_order Public Search Handlers HospitalController.java cross site scriptingEPSS 0.5%CVE-2026-31833MEDIUMUmbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringEPSS 0.5%CVE-2026-87923MEDIUMRizwan17 inventory-management-system List DBOperation.php cross site scriptingEPSS 0.5%CVE-2024-3138LOWfrancoisjacquet RosarioSIS Add Portal Note cross site scriptingEPSS 0.5%CVE-2026-79793MEDIUMcode-projects Online Shopping System sumit_form.php cross site scriptingEPSS 0.5%CVE-2026-15596MEDIUMSourceCodester Class and Exam Timetabling System subject.php cross site scriptingEPSS 0.5%CVE-2026-16485MEDIUMSourceCodester Class and Exam Timetabling System class.php cross site scriptingEPSS 0.5%CVE-2025-9211MEDIUMCross-site scripting in Otalio Ship Property Management SystemEPSS 0.5%CVE-2026-86278MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scriptingEPSS 0.5%CVE-2026-86244MEDIUMFastAdmin User Controller User.php login cross site scriptingEPSS 0.5%CVE-2026-82625MEDIUMcode-projects Simple Inventory System User Registration register.php cross site scriptingEPSS 0.5%CVE-2023-30057MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbiEPSS 0.5%CVE-2026-75078MEDIUMSourceCodester Class and Exam Timetabling System BSHRM1.php cross site scriptingEPSS 0.5%CVE-2026-15595MEDIUMSourceCodester Class and Exam Timetabling System forsubject.php cross site scriptingEPSS 0.5%