Falhas do tipo CWE-79

29.486 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-4648LOWCampcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scriptingEPSS 0.4%CVE-2022-48091MEDIUMTramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.EPSS 0.4%CVE-2025-24854MEDIUMApache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginEPSS 0.4%CVE-2023-1776HIGHStored XSS via SVG attachment on BoardsEPSS 0.4%CVE-2025-7761MEDIUMReflected XSS in Lepszy BIPEPSS 0.4%CVE-2024-30890MEDIUMCross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component.EPSS 0.4%CVE-2025-9158MEDIUMStored XSS in Request TrackerEPSS 0.4%CVE-2024-5437MEDIUMSourceCodester Simple Online Bidding System save_category cross site scriptingEPSS 0.4%CVE-2023-24721MEDIUMA cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.EPSS 0.4%CVE-2025-2205MEDIUMGDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-31757MEDIUMDedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'EPSS 0.4%CVE-2024-7285MEDIUMSourceCodester Establishment Billing Management System cross site scriptingEPSS 0.4%CVE-2024-6907MEDIUMSourceCodester Record Management System sort.php cross site scriptingEPSS 0.4%CVE-2023-1884MEDIUMCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.4%CVE-2026-34989CRITICALCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2024-29191MEDIUMGHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2022-0475LOWPossible XSS attack via translationEPSS 0.4%CVE-2024-26140MEDIUMcom.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement BrowserEPSS 0.4%CVE-2025-10794MEDIUMPHPGurukul Car Rental Project search.php cross site scriptingEPSS 0.4%CVE-2022-28980MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitraryEPSS 0.4%