Falhas do tipo CWE-79

30.668 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-26842MEDIUMA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the EPSS 1.4%CVE-2021-24934—Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2022-0385—Crazy Bone <= 0.6.0 - Unauthenticated Stored XSSEPSS 1.4%CVE-2024-47374HIGHWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.4%CVE-2024-26251MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.4%CVE-2023-35393MEDIUMAzure Apache Hive Spoofing VulnerabilityEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2016-10547—Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in auEPSS 1.4%CVE-2020-10688—A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haEPSS 1.4%CVE-2022-42711CRITICALIn Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could alEPSS 1.4%CVE-2026-26144HIGHMicrosoft Excel Information Disclosure VulnerabilityEPSS 1.4%CVE-2021-24241—Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.4%CVE-2022-2168—Download Manager < 3.2.44 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2022-42746MEDIUMCandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This EPSS 1.4%CVE-2021-3486—GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.EPSS 1.4%CVE-2023-45671MEDIUMFrigate reflected XSS through `/<camera_name>` API endpointsEPSS 1.4%CVE-2025-22466HIGHReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaEPSS 1.4%CVE-2024-53442CRITICALwhapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.EPSS 1.4%CVE-2021-1245MEDIUMCisco Finesse OpenSocial Gadget Editor Cross-Site Scripting VulnerabilityEPSS 1.4%