Falhas do tipo CWE-79

29.613 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-7835HIGHReflected XSS in Exnet Informatics Software's Ferry Reservation SystemEPSS 0.4%CVE-2024-34467MEDIUMThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.EPSS 0.4%CVE-2017-20193MEDIUMProduct Vendors <= 2.0.35 - Reflected Cross Site ScriptingEPSS 0.4%CVE-2023-31803MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencEPSS 0.4%CVE-2025-49130MEDIUMLaravel Translation Manager Vulnerable to Stored Cross-site ScriptingEPSS 0.4%CVE-2023-31804MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category EPSS 0.4%CVE-2025-55522MEDIUMCross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2024-12846MEDIUMEmlog Pro link.php cross site scriptingEPSS 0.4%CVE-2025-31483MEDIUMStored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configurationEPSS 0.4%CVE-2023-31802MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linediEPSS 0.4%CVE-2024-22491MEDIUMA Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameteEPSS 0.4%CVE-2022-23466MEDIUMDOM-based cross-site scripting (XSS) in teler dashboardEPSS 0.4%CVE-2024-7873CRITICALStored XSS in Veribilim Software's Veribase Order ManagementEPSS 0.4%CVE-2024-4776HIGHA file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126EPSS 0.4%CVE-2026-1721MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteEPSS 0.4%CVE-2026-87995HIGHOpen WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2024-47186MEDIUMFilament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site ScriptingEPSS 0.4%CVE-2024-55268MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing ManagEPSS 0.4%CVE-2024-35582MEDIUMA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2021-47843MEDIUMTagstoo 2.0.1 - Stored XSS to RCEEPSS 0.4%