Falhas do tipo CWE-79

29.816 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-54138MEDIUMXSS Vulnerability in NuGetGallery's Markdown Autolinks ProcessingEPSS 0.4%CVE-2025-26493MEDIUMIn JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tabEPSS 0.4%CVE-2022-48344MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.EPSS 0.4%CVE-2024-25226MEDIUMA cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2026-33172HIGHStatamic has Stored XSS via SVG Sanitization BypassEPSS 0.4%CVE-2024-12435MEDIUMCompare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12077MEDIUMBooking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'EPSS 0.4%CVE-2023-30469HIGHReflrected Cross Site Scripting Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.4%CVE-2025-2974MEDIUMCodeCanyon Perfex CRM Contracts contract cross site scriptingEPSS 0.4%CVE-2023-47814MEDIUMWordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-1955MEDIUMcode-projects Online Class and Exam Scheduling System profile.php cross site scriptingEPSS 0.4%CVE-2023-47831MEDIUMWordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12717MEDIUMaklamator-infeed <= 2.0.0 - Admin+ Stored XSSEPSS 0.4%CVE-2023-2343MEDIUMCross-site Scripting (XSS) - DOM in pimcore/pimcoreEPSS 0.4%CVE-2024-2087HIGHBrizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via FormEPSS 0.4%CVE-2024-25435MEDIUMA cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2024-13575MEDIUMWeb Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-5230MEDIUMTM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-4021MEDIUMModern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-40183MEDIUMReflected Cross Site Scripting (XSS) in VIDEOJET multi 4000EPSS 0.4%