Falhas do tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-25022MEDIUMUpdraftPlus < 1.16.66 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-45064HIGHApache Sling Engine: Include-based XSSEPSS 1.1%CVE-2022-1961MEDIUMGoogle Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDEPSS 1.1%CVE-2024-41357HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.EPSS 1.1%CVE-2022-1167—CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site ScriptingEPSS 1.1%CVE-2016-9465—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image exEPSS 1.1%CVE-2024-21394HIGHDynamics 365 Field Service Spoofing VulnerabilityEPSS 1.1%CVE-2022-1557—ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-41473MEDIUMRPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.EPSS 1.1%CVE-2021-24153—Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 1.1%CVE-2022-29618—Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, aEPSS 1.1%CVE-2025-22466HIGHReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaEPSS 1.1%CVE-2024-45061HIGHA cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTEPSS 1.1%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2019-14881MEDIUMA vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.EPSS 1.1%CVE-2019-3754MEDIUMDell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe320EPSS 1.1%CVE-2024-33299MEDIUMCross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last NameEPSS 1.1%CVE-2024-33297MEDIUMCross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal EPSS 1.1%CVE-2021-24985—Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2021-32681MEDIUMImproper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksEPSS 1.1%