Falhas do tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-13441HIGHEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' ParameterEPSS 0.4%CVE-2024-8572MEDIUMGouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scriptingEPSS 0.4%CVE-2024-3990MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover WidgetEPSS 0.4%CVE-2022-43696MEDIUMOX App Suite before 7.10.6-rev20 allows XSS via upsell ads.EPSS 0.4%CVE-2024-56199MEDIUMphpMyFAQ Vulnerable to Stored HTML Injection at FAQEPSS 0.4%CVE-2026-77263HIGHiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.4%CVE-2026-31281HIGHTotara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all thEPSS 0.4%CVE-2026-18109HIGHW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.4%CVE-2024-11456MEDIUMRun Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-84803HIGHSiYuan before v3.8.2 Stored XSS via incomplete asset blocklistEPSS 0.4%CVE-2022-33935MEDIUMDell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit thEPSS 0.4%CVE-2024-48461MEDIUMCross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the NewEPSS 0.4%CVE-2024-6355MEDIUMGenexis Tilgin Fiber Home Gateway HG1522 cross site scriptingEPSS 0.4%CVE-2024-28402MEDIUMTOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the FirewEPSS 0.4%CVE-2024-6954MEDIUMSourceCodester Record Management System sort1.php cross site scriptingEPSS 0.4%CVE-2022-47053MEDIUMAn arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to exeEPSS 0.4%CVE-2025-12716HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-58292MEDIUMXMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin TemplatesEPSS 0.4%CVE-2026-13114HIGHMotors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical InfoEPSS 0.4%CVE-2024-37395MEDIUMA stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitEPSS 0.4%