Falhas do tipo CWE-79

29.276 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-4655MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2024-32657MEDIUMHydra has persistent XSS vulnerability serving HTML build outputsEPSS 0.5%CVE-2022-43996MEDIUMThe csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF aEPSS 0.5%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2022-35722MEDIUMIBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.5%CVE-2022-2510MEDIUMPotential XSS on Special:SearchCenterEPSS 0.5%CVE-2026-49867MEDIUMDataEase: Authenticated Stored XSS in DataEase Template Static ResourcesEPSS 0.5%CVE-2021-36905MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-25705MEDIUMCross site scripting issue in embed widgetEPSS 0.5%CVE-2023-7015MEDIUMFile Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-2560LOWjja8 NewBingGoGo cross site scriptingEPSS 0.5%CVE-2022-3073MEDIUMQuaonos Schema ST4 example templates prone to XSSEPSS 0.5%CVE-2024-8716MEDIUMXT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1691MEDIUMOtter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG UploadEPSS 0.5%CVE-2023-49976MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.5%CVE-2026-3993MEDIUMitsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingEPSS 0.5%CVE-2021-44200—Self cross-site scripting (XSS) was possible on devices pageEPSS 0.5%CVE-2024-3687LOWbihell Dice Comment cross site scriptingEPSS 0.5%CVE-2021-44202—Stored cross-site scripting (XSS) was possible in activity detailsEPSS 0.5%CVE-2017-20191LOWZimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scriptingEPSS 0.5%