Falhas do tipo CWE-79

29.495 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-11366MEDIUMSEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-4892MEDIUMTeedy v1.11 - Stored cross-site scripting (XSS)EPSS 0.4%CVE-2022-40963MEDIUMWordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.4%CVE-2024-57427MEDIUMPHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user inputEPSS 0.4%CVE-2026-46686HIGHEmlog Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-6953MEDIUMMultiple vulnerabilities in Intermark IT's WebControl CMSEPSS 0.4%CVE-2024-48743MEDIUMCross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter.EPSS 0.4%CVE-2022-45214MEDIUMA cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTMEPSS 0.4%CVE-2021-31739MEDIUMThe SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attriEPSS 0.4%CVE-2026-73157LOWcti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataEPSS 0.4%CVE-2023-0538—Campaign URL Builder < 1.8.2 - Contributor+ Stored XSSEPSS 0.4%CVE-2023-1356HIGHReflected Cross-site Scripting In IDAttend’s IDWeb ApplicationEPSS 0.4%CVE-2023-47554MEDIUMWordPress Actueel Financieel Nieuws – Denk Internet Solutions Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-49864HIGHwetty vulnerable to DOM XSS via file-download filenameEPSS 0.4%CVE-2026-54759HIGHSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron clientEPSS 0.4%CVE-2026-66824CRITICALStored Cross-Site Scripting via Unsafe Capture Tree JSON EmbeddingEPSS 0.4%CVE-2022-43142MEDIUMA cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbEPSS 0.4%CVE-2023-0280MEDIUMUltimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSSEPSS 0.4%CVE-2021-47837MEDIUMMarkdownify 1.2.0 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2022-50586MEDIUMNagios XI < 5.8.9 Stored XSS via BPI Info URLEPSS 0.4%