Falhas do tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-26484MEDIUMA stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrarEPSS 0.4%CVE-2024-30986MEDIUMCross Site Scripting vulnerability in /edit-services-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackeEPSS 0.4%CVE-2025-40697MEDIUMReflected Cross-Site Scripting (XSS) in Lewe WebMeasureEPSS 0.4%CVE-2024-2436MEDIUMLightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-1496MEDIUMFeatured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_urlEPSS 0.4%CVE-2023-32325MEDIUMCross-site scripting in PostHog-jsEPSS 0.4%CVE-2022-44031MEDIUMRedmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syEPSS 0.4%CVE-2024-4335MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-3831MEDIUMEnter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widgetEPSS 0.4%CVE-2022-44213MEDIUMZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-1235MEDIUMElementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-26468MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers EPSS 0.4%CVE-2024-23341MEDIUMTuiTse-TsuSin html injection vulnerability in `tuitse_html` functionEPSS 0.4%CVE-2024-11456MEDIUMRun Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-18109HIGHW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.4%CVE-2026-22720HIGHVMware Aria Operations stored cross-site scripting vulnerabilityEPSS 0.4%CVE-2024-48410MEDIUMCross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.EPSS 0.4%CVE-2026-13441HIGHEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' ParameterEPSS 0.4%CVE-2026-73041CRITICALSiYuan before v3.7.4 Remote Code Execution via PDF AnnotationsEPSS 0.4%CVE-2024-8572MEDIUMGouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scriptingEPSS 0.4%