Falhas do tipo CWE-79

29.772 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-86431MEDIUMcommonmark before 2.9.1 XSS via AttributesExtension form feed bypassEPSS 0.4%CVE-2025-23697HIGHWordPress Podčlánková inzerce plugin <= 2.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6423MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-25614MEDIUMSAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unautEPSS 0.4%CVE-2023-4175LOWmooSocial mooTravel cross site scriptingEPSS 0.4%CVE-2023-3827LOWBug Finder Listplace Directory Listing Platform HTTP POST Request create cross site scriptingEPSS 0.4%CVE-2024-7737HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.4%CVE-2023-4594MEDIUMCross-site Scripting in BVRP Software SLmailEPSS 0.4%CVE-2022-27860MEDIUMWordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6011MEDIUMStored XSS in GeodiEPSS 0.4%CVE-2023-3659LOWSourceCodester AC Repair and Services System cross site scriptingEPSS 0.4%CVE-2023-3544LOWGZ Scripts Time Slot Booking Calendar PHP load.php cross site scriptingEPSS 0.4%CVE-2023-6426MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-6359MEDIUMCross-Site Scripting in Alumne LMSEPSS 0.4%CVE-2024-9291MEDIUMkalvinGit kvf-admin XML File cross site scriptingEPSS 0.4%CVE-2025-45805HIGHIn phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profileEPSS 0.4%CVE-2022-29436MEDIUMWordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-53610HIGHGLPI: Reflected XSS in dashboardsEPSS 0.4%CVE-2022-40034MEDIUMCross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' paraEPSS 0.4%CVE-2024-31783MEDIUMCross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a craftedEPSS 0.4%