Falhas do tipo CWE-79

30.465 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-0218HIGHWP HTML Mail <= 3.0.9 Missing Authorization on REST-API RouteEPSS 66.4%CVE-2023-2164MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 66.3%CVE-2021-25919MEDIUMIn OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A hiEPSS 66.1%CVE-2022-36094HIGHXWiki Platform Web Parent POM vulnerable to XSS in the attachment historyEPSS 64.8%CVE-2022-21662HIGHStored XSS in WordPressEPSS 64.5%CVE-2023-43770MEDIUMRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of EPSS 63.7%KEVCVE-2024-50599MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the weEPSS 63.6%CVE-2024-2194HIGHWP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 63.2%CVE-2022-25772CRITICALA cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executableEPSS 63.0%CVE-2025-46618LOWIn JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabEPSS 63.0%CVE-2023-28651MEDIUMCross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected produEPSS 62.4%CVE-2025-5301MEDIUMReflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)EPSS 62.4%CVE-2023-34220MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possibleEPSS 61.4%CVE-2024-27136MEDIUMApache JSPWiki: Cross-site scripting vulnerability on upload pageEPSS 60.8%CVE-2023-34225MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possibleEPSS 60.7%CVE-2025-2748MEDIUMKentico Xperience stored cross-site scripting in multiple-file upload functionalityEPSS 60.6%CVE-2023-4547MEDIUMSPA-Cart eCommerce CMS search cross site scriptingEPSS 60.3%CVE-2022-36096HIGHXWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listEPSS 60.2%CVE-2022-46889MEDIUMA persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject EPSS 60.1%CVE-2022-48343MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.EPSS 59.5%