Falhas do tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-45033MEDIUMA cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.5%CVE-2026-15596MEDIUMSourceCodester Class and Exam Timetabling System subject.php cross site scriptingEPSS 0.5%CVE-2026-90571MEDIUMExrick xmall Order Printing order-print.jsp cross site scriptingEPSS 0.5%CVE-2026-84695CRITICALBookStack before 26.05.4 Stored XSS via Drawing UploadEPSS 0.5%CVE-2023-28692MEDIUMWordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-13556MEDIUMitsourcecode Online Hotel Management System POST Request controller.php edit cross site scriptingEPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2026-87923MEDIUMRizwan17 inventory-management-system List DBOperation.php cross site scriptingEPSS 0.5%CVE-2022-45008MEDIUMOnline Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_systEPSS 0.5%CVE-2023-39683MEDIUMCross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user inpEPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2022-44069MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.EPSS 0.5%CVE-2024-1084MEDIUMCross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that reqEPSS 0.5%CVE-2023-6488MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2022-44073MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.EPSS 0.5%CVE-2024-22569MEDIUMStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /indexEPSS 0.5%CVE-2024-57277MEDIUMInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.EPSS 0.5%CVE-2024-1236MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-13736MEDIUMPure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName ParameterEPSS 0.5%