Falhas do tipo CWE-79

29.286 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-11196MEDIUMMulti-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap ShortcodeEPSS 0.5%CVE-2022-46058MEDIUMAeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers toEPSS 0.5%CVE-2026-34569CRITICALCI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2026-34560CRITICALCI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2025-62780LOWchangedetection.io vulnerable to stored XSS in Watch update via APIEPSS 0.5%CVE-2024-2117MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path WidgetEPSS 0.5%CVE-2022-1075LOWCollege Website Management System Contact cross site scriptingEPSS 0.5%CVE-2023-22638MEDIUMSeveral improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9EPSS 0.5%CVE-2026-25640HIGHPydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLEPSS 0.5%CVE-2024-6848MEDIUMPost and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File UploadEPSS 0.5%CVE-2024-3402MEDIUMStored XSS vulnerability in gaizhenbiao/chuanhuchatgptEPSS 0.5%CVE-2023-3080HIGHWP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2023-44310CRITICALStored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throEPSS 0.5%CVE-2022-2645LOWSourceCodester Garage Management System edituser.php cross site scriptingEPSS 0.5%CVE-2023-3168HIGHWP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2021-37781MEDIUMEmployee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.EPSS 0.5%CVE-2023-3122HIGHGD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2024-2967MEDIUMGuest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-47878HIGHReflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)EPSS 0.5%CVE-2021-23287MEDIUMSecurity issues in Intelligent Power Manager (IPM 1)EPSS 0.5%