Falhas do tipo CWE-79

29.665 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-6339MEDIUMPhlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search ParametersEPSS 0.4%CVE-2023-49182HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by AuthoEPSS 0.4%CVE-2026-53992MEDIUMReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date ParametersEPSS 0.4%CVE-2024-2595HIGHCross-Site Scripting (XSS) in AMSS++EPSS 0.4%CVE-2024-41675MEDIUMCKAN has a Cross-site Scripting vector in the Datatables view pluginEPSS 0.4%CVE-2023-2327MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.4%CVE-2023-38400HIGHWordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40667HIGHWordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11337MEDIUMHoroscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-56990MEDIUMPHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php.EPSS 0.4%CVE-2026-26023MEDIUMClient‑side DOM XSS in the web chat app of Dify when using echartsEPSS 0.4%CVE-2024-11188MEDIUMFormidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form ParameterEPSS 0.4%CVE-2024-25107MEDIUMCross-Site Scripting in WikiDiscoverEPSS 0.4%CVE-2024-36230MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-11091MEDIUMSupport SVG – Upload svg files in wordpress without hassle <= 1.1.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG File UploadEPSS 0.4%CVE-2023-52265MEDIUMIDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update EPSS 0.4%CVE-2024-13132MEDIUMEmlog Pro Subpage article.php cross site scriptingEPSS 0.4%CVE-2023-50828MEDIUMWordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8152MEDIUMSourceCodester QR Code Bookmark System Parameter add-bookmark.php cross site scriptingEPSS 0.4%CVE-2023-4963MEDIUMWS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%