Falhas do tipo CWE-79

29.814 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-3794MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2022-41947MEDIUMCross-site Scripting with user-uploaded files in dhis2-core EPSS 0.4%CVE-2023-36259MEDIUMCross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during usEPSS 0.4%CVE-2024-3793MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2024-3791MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2024-55659HIGHSiYuan has an arbitrary file write in the host via /api/asset/uploadEPSS 0.4%CVE-2024-25381MEDIUMThere is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.EPSS 0.4%CVE-2023-50092MEDIUMAPIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2026-85645MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-27059HIGHA cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2023-23467HIGHMedia CP Media Control Panel – Reflected XSSEPSS 0.4%CVE-2024-10510MEDIUMadBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSSEPSS 0.4%CVE-2023-47626HIGHiTop vulnerable to XSS vulnerability in authent-tokenEPSS 0.4%CVE-2025-6185HIGHLeviton AcquiSuite and Energy Monitoring Hub Cross-site ScriptingEPSS 0.4%CVE-2025-9728MEDIUMgivanz Vvveb login.tpl cross site scriptingEPSS 0.4%CVE-2024-53278MEDIUMCross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the adEPSS 0.4%CVE-2023-51461MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-45254HIGHVaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.4%CVE-2023-51460MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-5878MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryEPSS 0.4%