Falhas do tipo CWE-79

29.846 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-38536MEDIUMHTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1. The vulnerability could result in Cross site scripting.  EPSS 0.4%CVE-2025-15223MEDIUMPhilipinho Simple-PHP-Blog login.php cross site scriptingEPSS 0.4%CVE-2024-2299HIGHStored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webuiEPSS 0.4%CVE-2024-21516LOWThis affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directorEPSS 0.4%CVE-2024-3174HIGHInappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruptiEPSS 0.4%CVE-2023-47532MEDIUMWordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-32769MEDIUMPhoto StationEPSS 0.4%CVE-2024-41614MEDIUMsymphonycms <=2.7.10 is vulnerable to Cross Site Scripting (XSS) in the Comment component for articles.EPSS 0.4%CVE-2023-41250LOWIn JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registrationEPSS 0.4%CVE-2023-40605MEDIUMWordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-11946MEDIUMLogicalDOC Community Edition Add Contact frontend.jsp cross site scriptingEPSS 0.4%CVE-2024-36773MEDIUMA cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payEPSS 0.4%CVE-2026-82654CRITICALSiYuan before v3.8.1 Stored XSS via block nameEPSS 0.4%CVE-2022-41299MEDIUMIBM Cloud Transformation Advisor cross-site scriptingEPSS 0.4%CVE-2023-0577MEDIUMMultiple XSS in ASOS Information Technologies' SobiadEPSS 0.4%CVE-2024-21515LOWThis affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the aEPSS 0.4%CVE-2024-32767MEDIUMPhoto StationEPSS 0.4%CVE-2024-45964MEDIUMZenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.EPSS 0.4%CVE-2023-0578MEDIUMMultiple XSS in ASOS Information Technologies' Book CitesEPSS 0.4%CVE-2024-29273MEDIUMThere is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.EPSS 0.4%