Falhas do tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24985—Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2021-32733MEDIUMXSS in Nextcloud Text applicationEPSS 1.1%CVE-2024-52943MEDIUMAn issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to injeEPSS 1.1%CVE-2022-0690HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.1%CVE-2025-9787MEDIUMStored XSSEPSS 1.1%CVE-2025-49542MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.1%CVE-2016-9454—Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,EPSS 1.1%CVE-2020-15118MEDIUMCross-Site Scripting in WagtailEPSS 1.1%CVE-2023-0432CRITICALCVE-2023-0432EPSS 1.1%CVE-2017-15100—An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking onEPSS 1.1%CVE-2017-12175LOWRed Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.EPSS 1.1%CVE-2021-39222MEDIUMXSS in TalkEPSS 1.1%CVE-2020-26211HIGHCross-Site Scripting in BookStackEPSS 1.1%CVE-2023-5863HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 1.1%CVE-2019-3808MEDIUMA flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage grEPSS 1.1%CVE-2019-1665MEDIUMCisco Hyperflex Stored Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2016-8634MEDIUMA vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the secondEPSS 1.1%CVE-2022-2089—Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-0838MEDIUMCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 1.1%CVE-2021-21441HIGHXSS in the ticket overview screensEPSS 1.1%