Falhas do tipo CWE-79

29.308 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-34089HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%CVE-2024-52526MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phpEPSS 0.5%CVE-2024-4216HIGHXSS vulnerability in /settings/store API response json payload in pgAdmin 4EPSS 0.5%CVE-2025-3533MEDIUMYouDianCMS index.html.Attackers cross site scriptingEPSS 0.5%CVE-2026-15346MEDIUMVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' ParameterEPSS 0.5%CVE-2023-29305MEDIUMAdobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code executionEPSS 0.5%CVE-2022-40606MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2024-41665MEDIUMAmpache Stored Cross-site Scripting VulnerabilityEPSS 0.5%CVE-2022-2365MEDIUMCross-site Scripting (XSS) - Stored in zadam/triliumEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2026-21290HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.5%CVE-2022-40605MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2024-33371MEDIUMCross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the mEPSS 0.5%CVE-2026-18478MEDIUMStored XSS in Magnolia CMSEPSS 0.5%CVE-2024-24041MEDIUMA stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arEPSS 0.5%CVE-2026-64851HIGHGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersEPSS 0.5%CVE-2025-32015MEDIUMFreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>EPSS 0.5%CVE-2023-44311CRITICALMultiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class iEPSS 0.5%CVE-2023-42497CRITICALReflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and LiferaEPSS 0.5%