Falhas do tipo CWE-79

29.626 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-27625MEDIUMCMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admEPSS 0.4%CVE-2024-8991MEDIUMOSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 ShortcodesEPSS 0.4%CVE-2023-5895LOWCross-site Scripting (XSS) - DOM in pkp/pkp-libEPSS 0.4%CVE-2023-41653HIGHWordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41236HIGHWordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-35884HIGHWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9923MEDIUMCampcodes Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2024-50532HIGHWordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56314MEDIUMA stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject maliciouEPSS 0.4%CVE-2025-4987HIGHStored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%CVE-2024-30880MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.4%CVE-2019-17003MEDIUMScanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.EPSS 0.4%CVE-2024-51093HIGHStored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScripEPSS 0.4%CVE-2023-27629MEDIUMWordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51497MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.phpEPSS 0.4%CVE-2024-28091MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 0.4%CVE-2024-54390HIGHWordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-34401MEDIUMSavsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter.EPSS 0.4%CVE-2024-22639MEDIUMiGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing iEPSS 0.4%