Falhas do tipo CWE-79

30.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-38066MEDIUMIn JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloadsEPSS 1.1%CVE-2022-0690HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.1%CVE-2025-9787MEDIUMStored XSSEPSS 1.1%CVE-2025-60378HIGHStored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.EPSS 1.1%CVE-2016-9454—Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,EPSS 1.1%CVE-2022-37461MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitraryEPSS 1.1%CVE-2020-15118MEDIUMCross-Site Scripting in WagtailEPSS 1.1%CVE-2017-15100—An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking onEPSS 1.1%CVE-2023-0432CRITICALCVE-2023-0432EPSS 1.1%CVE-2017-12175LOWRed Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.EPSS 1.1%CVE-2021-39222MEDIUMXSS in TalkEPSS 1.1%CVE-2020-26211HIGHCross-Site Scripting in BookStackEPSS 1.1%CVE-2022-43165MEDIUMA stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1EPSS 1.1%CVE-2022-43166MEDIUMA stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1EPSS 1.1%CVE-2022-43164MEDIUMA stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 aEPSS 1.1%CVE-2022-43170MEDIUMA stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of RukEPSS 1.1%CVE-2025-64672HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.1%CVE-2019-1665MEDIUMCisco Hyperflex Stored Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2016-8634MEDIUMA vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the secondEPSS 1.1%CVE-2022-0838MEDIUMCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 1.1%