Falhas do tipo CWE-79

28.445 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-26829MEDIUMOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.EPSS 48.0%KEVCVE-2011-0096MEDIUMThe MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 GoldEPSS 46.8%CVE-2023-37580MEDIUMZimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.EPSS 46.7%KEVCVE-2022-39197MEDIUMAn XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTMEPSS 46.4%KEVCVE-2025-0133LOWPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and PortalEPSS 46.4%CVE-2024-43573MEDIUMWindows MSHTML Platform Spoofing VulnerabilityEPSS 46.1%KEVCVE-2022-45938HIGHAn issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device EPSS 45.1%CVE-2025-6023HIGHAn open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introdEPSS 45.0%CVE-2022-28818MEDIUMColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code ExecutionEPSS 44.8%CVE-2024-53457MEDIUMA stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executeEPSS 44.6%CVE-2022-3062MEDIUMSimple File List < 4.4.12 - Reflected Cross-Site ScriptingEPSS 44.1%CVE-2023-0448MEDIUMThe WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected croEPSS 42.9%CVE-2025-29513MEDIUMCross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API AccessEPSS 42.8%CVE-2022-43568HIGHReflected Cross-Site Scripting via the radio template in Splunk EnterpriseEPSS 42.8%CVE-2020-13954—Apache CXF Reflected XSS in the services listing page via the styleSheetPathEPSS 40.9%CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2024-57041MEDIUMA persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' seEPSS 39.3%CVE-2023-30777HIGHWordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)EPSS 38.8%