Falhas do tipo CWE-79

29.655 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-27228MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-40657—Extension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.5EPSS 0.4%CVE-2026-27239MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-27256MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-27237MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-54041MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-76562HIGHSidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' ParameterEPSS 0.4%CVE-2024-54040MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-27249MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-40624MEDIUMCode Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)EPSS 0.4%CVE-2024-2128MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF WidgetEPSS 0.4%CVE-2024-48195MEDIUMCross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the pEPSS 0.4%CVE-2026-27241MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-37146MEDIUMGHSL-2023-248: Flowise xss in /api/v1/credentials/idEPSS 0.4%CVE-2026-50712MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingEPSS 0.4%CVE-2026-55661MEDIUMTinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesEPSS 0.4%CVE-2026-27229MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-57531MEDIUMMilkdown < 7.21.3 DOM XSS via innerHTML AssignmentEPSS 0.4%CVE-2024-54039MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-6818HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' ParameterEPSS 0.4%