Falhas do tipo CWE-79

29.345 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-36864LOWWordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2021-31834—McAfee ePO Cross-Site Scripting vulnerabilityEPSS 0.5%CVE-2024-44872MEDIUMA reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user'sEPSS 0.5%CVE-2026-27970HIGHAngular i18n vulnerable to Cross-Site Scripting (XSS)EPSS 0.5%CVE-2024-4398MEDIUMHTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.5%CVE-2024-11975MEDIUMReactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-34899MEDIUMWWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).EPSS 0.5%CVE-2023-32984MEDIUMJenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and dispEPSS 0.5%CVE-2023-3996MEDIUMARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-39926MEDIUMAn issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML EPSS 0.5%CVE-2024-32345HIGHA cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML EPSS 0.5%CVE-2023-31816MEDIUMIT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /ecoEPSS 0.5%CVE-2021-37211MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Stored XSSEPSS 0.5%CVE-2023-50609MEDIUMCross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute EPSS 0.5%CVE-2023-33007MEDIUMJenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (EPSS 0.5%CVE-2021-32540MEDIUMHundred Plus 101EIP - Stored XSS-2EPSS 0.5%CVE-2023-43728MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-11458MEDIUMFAQ Builder AYS <= 1.7.1 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-43733MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2022-29610—SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could resultEPSS 0.5%