Falhas do tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-21520MEDIUMVersions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fEPSS 1.1%CVE-2022-31127HIGHImproper handling of email input in next-authEPSS 1.1%CVE-2021-40714MEDIUMAdobe Experience Manager Reflected Cross Site Scripting via accesskey parameterEPSS 1.1%CVE-2021-24310—Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery TitleEPSS 1.1%CVE-2024-28160HIGHJenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingEPSS 1.1%CVE-2025-2609HIGHMagnusBilling Stored Cross-Site Scripting in Login LogsEPSS 1.1%CVE-2026-26105HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.1%CVE-2021-32478—The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versioEPSS 1.1%CVE-2007-5954MEDIUMCross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary web script or HTML viEPSS 1.1%CVE-2019-18578CRITICALDell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of EPSS 1.1%CVE-2021-21079MEDIUMAdobe Connect Reflected Cross-site Scripting via archiveOffset parameterEPSS 1.1%CVE-2021-24833—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview ModuleEPSS 1.1%CVE-2022-42747MEDIUMCandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is EPSS 1.1%CVE-2022-42748MEDIUMCandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TEPSS 1.1%CVE-2022-3123MEDIUMCross-site Scripting (XSS) - Reflected in splitbrain/dokuwikiEPSS 1.1%CVE-2020-12517HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).EPSS 1.1%CVE-2022-42749MEDIUMCandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poEPSS 1.1%CVE-2024-50053MEDIUMStored XSSEPSS 1.1%CVE-2021-29459CRITICALXSS Cross Site ScriptingEPSS 1.1%CVE-2021-25022MEDIUMUpdraftPlus < 1.16.66 - Reflected Cross-Site ScriptingEPSS 1.1%