Falhas do tipo CWE-79

29.761 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-46948MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitEPSS 0.4%CVE-2025-1319HIGHSite Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11368MEDIUMSplash Sync <= 2.0.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4632MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.4%CVE-2023-20074MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2024-5062MEDIUMReflected XSS through survey redirect parameter in zenml-io/zenmlEPSS 0.4%CVE-2024-49764MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.phpEPSS 0.4%CVE-2024-11683MEDIUMNewsletter Subscriptions <= 2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4333MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site ScriptingEPSS 0.4%CVE-2026-53722MEDIUMNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLEPSS 0.4%CVE-2024-12260MEDIUMUltimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2021-46680MEDIUMVulnerability XSS in module form name fieldEPSS 0.4%CVE-2025-1085MEDIUMAnimati PACS login cross site scriptingEPSS 0.4%CVE-2024-50350MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phpEPSS 0.4%CVE-2026-44282MEDIUMElection question titles allow stored script executionEPSS 0.4%CVE-2023-20041MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2022-36783MEDIUMAlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)EPSS 0.4%CVE-2026-45025MEDIUMWeGIA: Stored XSS in html/atendido/etapa_processo.phpEPSS 0.4%CVE-2023-50303MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%