Falhas do tipo CWE-79

29.508 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-38832HIGHStored cross-site scripting vulnerability (CVE-2024-38832)EPSS 0.4%CVE-2024-12466MEDIUMProofreading <= 1.2.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-24769HIGHNocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadEPSS 0.4%CVE-2024-8663MEDIUMWP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-23830HIGHWordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3647MEDIUMPremium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'EPSS 0.4%CVE-2024-31847MEDIUMAn issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticatedEPSS 0.4%CVE-2022-47444HIGHWordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34343MEDIUMCross-site Scripting (XSS) in navigateTo if used after SSR in nuxtEPSS 0.4%CVE-2023-4829MEDIUMCross-site Scripting (XSS) - Stored in froxlor/froxlorEPSS 0.4%CVE-2021-27781MEDIUMHCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scriptingEPSS 0.4%CVE-2023-1237LOWCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.4%CVE-2026-32277HIGHConnect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List ViewEPSS 0.4%CVE-2022-50797MEDIUMStripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via SettingsEPSS 0.4%CVE-2023-26146MEDIUMAll versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciEPSS 0.4%CVE-2023-29854MEDIUMDirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.EPSS 0.4%CVE-2024-25895MEDIUMA reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via tEPSS 0.4%CVE-2024-42763MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1EPSS 0.4%CVE-2023-26788MEDIUMVeritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to beEPSS 0.4%CVE-2023-31165MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%