Falhas do tipo CWE-79

29.655 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-20206MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2026-27231MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-40656—Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01EPSS 0.4%CVE-2026-76562HIGHSidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' ParameterEPSS 0.4%CVE-2026-27249MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-4388HIGHForm Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text BoxEPSS 0.4%CVE-2026-27254MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-50712MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingEPSS 0.4%CVE-2024-37146MEDIUMGHSL-2023-248: Flowise xss in /api/v1/credentials/idEPSS 0.4%CVE-2025-57768MEDIUMStored XSS in “hours” fields when creating or editing an issue, using SQLite databaseEPSS 0.4%CVE-2026-27241MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-54040MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-55661MEDIUMTinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesEPSS 0.4%CVE-2026-10734HIGHInfility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log EndpointEPSS 0.4%CVE-2026-6818HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' ParameterEPSS 0.4%CVE-2024-48195MEDIUMCross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the pEPSS 0.4%CVE-2024-36423MEDIUMGHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idEPSS 0.4%CVE-2023-40655—Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.0EPSS 0.4%CVE-2026-90650HIGHMotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'EPSS 0.4%CVE-2023-40628—Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15EPSS 0.4%