Falhas do tipo CWE-79

29.371 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-3642MEDIUMGZ Scripts Vacation Rental Website HTTP POST Request cross site scriptingEPSS 0.4%CVE-2026-3220HIGHMultiple Plugins - Unauthenticated Stored XSS via Minify LibraryEPSS 0.4%CVE-2023-27888MEDIUMCross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script vEPSS 0.4%CVE-2025-0443HIGHInsufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage EPSS 0.4%CVE-2023-20069MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-30614HIGHImproper Neutralization of Script-Related HTML Tags in a Web Page in payEPSS 0.4%CVE-2024-11442MEDIUMHorizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-49974MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.4%CVE-2024-25737MEDIUMA Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VEPSS 0.4%CVE-2023-2739MEDIUMGira HomeServer hslist cross site scriptingEPSS 0.4%CVE-2023-41619MEDIUMEmlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.EPSS 0.4%CVE-2026-5743MEDIUMMixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block AttributeEPSS 0.4%CVE-2024-12523MEDIUMStates Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-55166MEDIUMsvg-sanitizer By-Passing Attribute SanitizationEPSS 0.4%CVE-2023-3641MEDIUMkhodakhah NodCMS POST Request blog-comment-4 cross site scriptingEPSS 0.4%CVE-2025-0447HIGHInappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalationEPSS 0.4%CVE-2026-75993HIGHColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2022-44235MEDIUMBeijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-2525LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System receipt.php cross site scriptingEPSS 0.4%CVE-2026-75966MEDIUMPodlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' ParameterEPSS 0.4%