Falhas do tipo CWE-79

29.607 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-47067MEDIUMAlist Contains a Reflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-24906HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adEPSS 0.4%CVE-2026-108834MEDIUMCairo-dock Glx-Dock Query Parameter ww_page.php cross site scriptingEPSS 0.4%CVE-2024-51091MEDIUMCross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packageEPSS 0.4%CVE-2024-41514MEDIUMA reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject EPSS 0.4%CVE-2023-27089HIGHCross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parEPSS 0.4%CVE-2024-1463MEDIUMLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-41515MEDIUMA reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbEPSS 0.4%CVE-2024-1571MEDIUMWP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video EmbedEPSS 0.4%CVE-2022-43754LOWSUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.doEPSS 0.4%CVE-2023-4773MEDIUMWordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-38506HIGHCross-site Scripting (XSS) when pasting HTML into the rich text editor in JoplinEPSS 0.4%CVE-2022-39020HIGHCross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.4%CVE-2024-46209MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrEPSS 0.4%CVE-2026-3907MEDIUMHostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' ShortcodeEPSS 0.4%CVE-2024-41516MEDIUMA Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web EPSS 0.4%CVE-2022-42119MEDIUMCertain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4EPSS 0.4%CVE-2023-30435HIGHIBM Security Guardium cross-site scriptingEPSS 0.4%CVE-2024-24907HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. EPSS 0.4%CVE-2025-2583MEDIUMSimpleMachines SMF ManageNews.php cross site scriptingEPSS 0.4%