Falhas do tipo CWE-79

29.486 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2024-53988LOWPossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0EPSS 0.4%CVE-2022-28982MEDIUMA cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackeEPSS 0.4%CVE-2024-8583MEDIUMSourceCodester Online Bank Management System Feedback mfeedback.php cross site scriptingEPSS 0.4%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2024-7200MEDIUMSourceCodester Complaints Report Management System cross site scriptingEPSS 0.4%CVE-2024-7739MEDIUMyzane vscode-markdown-pdf cross site scriptingEPSS 0.4%CVE-2024-8951MEDIUMSourceCodester Resort Reservation System manage_fee.php cross site scriptingEPSS 0.4%CVE-2024-9611MEDIUMIncrease upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28070MEDIUMA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to EPSS 0.4%CVE-2026-35218HIGHBudibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command PaletteEPSS 0.4%CVE-2022-45755MEDIUMCross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the bEPSS 0.4%CVE-2024-7793MEDIUMSourceCodester Task Progress Tracker add-task.php cross site scriptingEPSS 0.4%CVE-2024-7466MEDIUMPMWeb Web Application Firewall cross site scriptingEPSS 0.4%CVE-2022-41319MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServEPSS 0.4%CVE-2021-4035LOWWocu Monitoring stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-51652MEDIUMOWASP.AntiSamy mXSS when preserving commentsEPSS 0.4%CVE-2024-8337MEDIUMSourceCodester Contact Manager with Export to VCF index.html cross site scriptingEPSS 0.4%CVE-2024-7068MEDIUMSourceCodester Insurance Management System update_sub_category cross site scriptingEPSS 0.4%CVE-2024-7948MEDIUMSourceCodester Accounts Manager App Update Account Page update-account.php cross site scriptingEPSS 0.4%