Falhas do tipo CWE-79

29.495 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-47838MEDIUMMarkright 1.0 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2021-47837MEDIUMMarkdownify 1.2.0 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2023-2817MEDIUMA post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be iEPSS 0.4%CVE-2024-53930MEDIUMWikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser.EPSS 0.4%CVE-2026-53693MEDIUMMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsEPSS 0.4%CVE-2025-12460MEDIUMStored XSS vulnerability in Afterlogic Aurora webmailEPSS 0.4%CVE-2021-47698MEDIUMNagios XI < 5.8.7 XSS in Core UI Views URL handlingEPSS 0.4%CVE-2023-0152MEDIUMWP Multi Store Locator <= 2.4 - Contributor+ Stored XSSEPSS 0.4%CVE-2024-34437MEDIUMWordPress Form Maker by 10Web plugin <= 1.15.24 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-49864HIGHwetty vulnerable to DOM XSS via file-download filenameEPSS 0.4%CVE-2024-1791MEDIUMCodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-6182MEDIUMLabVantage LIMS cross site scriptingEPSS 0.4%CVE-2026-66918HIGHDOM-Based Cross-Site Scripting via Unsanitized SVG Node IconsEPSS 0.4%CVE-2023-0374MEDIUMW4 Post List < 2.4.6 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-47376MEDIUMNocoDB: Reflected Cross-Site Scripting via Password Reset TokenEPSS 0.4%CVE-2022-44787MEDIUMAn issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idEPSS 0.4%CVE-2026-73848MEDIUMEmlog: Stored XSS via Tag Name in Article EditorEPSS 0.4%CVE-2022-31743MEDIUMFirefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been uEPSS 0.4%CVE-2020-3431MEDIUMCisco Small Business RV Series Routers Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2021-31740MEDIUMSEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XEPSS 0.4%