Falhas do tipo CWE-79

29.816 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-43376HIGH A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause codeEPSS 0.4%CVE-2023-39370HIGH StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) EPSS 0.4%CVE-2025-65778HIGHAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be servedEPSS 0.4%CVE-2024-27091MEDIUMGeoNode stored XSS to full account takeoverEPSS 0.4%CVE-2023-31180MEDIUM WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS)EPSS 0.4%CVE-2023-51457MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2025-59974CRITICALJunos Space Security Director: Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-59672MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.4%CVE-2023-33322HIGHWordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-51463MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2023-30472HIGHWordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54998MEDIUMMonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/deEPSS 0.4%CVE-2024-4234MEDIUMWordPress Filterable Portfolio plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-46072HIGHWordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-59673MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.4%CVE-2023-51464MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-25369MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the grEPSS 0.4%CVE-2026-33135CRITICALWeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameterEPSS 0.4%CVE-2023-51462MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-6092MEDIUMcomfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scriptingEPSS 0.4%