Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-50982CRITICALStud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysControEPSS 1.3%CVE-2022-0831MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.3%CVE-2020-15155HIGHCross-Site Scripting in baserCMSEPSS 1.3%CVE-2011-1497—A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.EPSS 1.3%CVE-2024-49379MEDIUMRemote Code Execution (RCE) via Cross-Site Scripting (XSS) in UmbrelEPSS 1.3%CVE-2021-24693—Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File ThumbnailEPSS 1.3%CVE-2024-5961MEDIUMReflected XSS in 2ClickPortalEPSS 1.3%CVE-2017-16771—Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackeEPSS 1.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2019-19293MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Control Center Server (EPSS 1.3%CVE-2008-0642MEDIUMCross-site scripting (XSS) vulnerability in files created by Adobe RoboHelp 6 and 7, possibly involving use of a (1) WebHelp5 (WebHelp5Ext) EPSS 1.3%CVE-2023-30627CRITICALjellyfin-web has a stored cross-site scripting vulnerability in devices.jsEPSS 1.3%CVE-2006-5632MEDIUMCross-site scripting (XSS) vulnerability in change_pass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML viEPSS 1.3%CVE-2023-50250MEDIUMCross-Site Scripting vulnerability when Import xml template fileEPSS 1.3%CVE-2021-20280—Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8,EPSS 1.3%CVE-2023-36016MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.3%CVE-2026-61876CRITICALLuCI DHCPv6 Lease Hostname Stored Cross-Site ScriptingEPSS 1.3%CVE-2023-29528CRITICALCross-site Scripting in org.xwiki.commons:xwiki-commons-xmlEPSS 1.3%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%CVE-2018-0340—A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote EPSS 1.3%