Falhas do tipo CWE-79

30.668 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2017-16016—Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XEPSS 1.3%CVE-2022-0429—WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2022-31358CRITICALA reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitEPSS 1.3%CVE-2024-27744MEDIUMCross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloaEPSS 1.3%CVE-2024-20679MEDIUMAzure Stack Hub Spoofing VulnerabilityEPSS 1.3%CVE-2021-24973—Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2021-24975—NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSSEPSS 1.3%CVE-2019-7608—Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive infoEPSS 1.3%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%CVE-2021-34638MEDIUMWordPress Download Manager <= 3.1.24 Authenticated Directory TraversalEPSS 1.3%CVE-2023-44012MEDIUMCross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in tEPSS 1.3%CVE-2022-42747MEDIUMCandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is EPSS 1.3%CVE-2025-36548HIGHA cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and EPSS 1.3%CVE-2022-42749MEDIUMCandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poEPSS 1.3%CVE-2022-42748MEDIUMCandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TEPSS 1.3%CVE-2022-2627MEDIUMNewspaper < 12 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2025-49542MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.3%CVE-2021-30134MEDIUMphp-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST dataEPSS 1.3%CVE-2019-10221MEDIUMA Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. EPSS 1.3%CVE-2021-25086—Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%