Falhas do tipo CWE-79

29.846 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-21515LOWThis affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the aEPSS 0.4%CVE-2022-41299MEDIUMIBM Cloud Transformation Advisor cross-site scriptingEPSS 0.4%CVE-2023-0578MEDIUMMultiple XSS in ASOS Information Technologies' Book CitesEPSS 0.4%CVE-2024-36773MEDIUMA cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payEPSS 0.4%CVE-2023-29188MEDIUMCross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UIEPSS 0.4%CVE-2024-3916MEDIUMSwift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodesEPSS 0.4%CVE-2025-2699MEDIUMGetmeUK ContentTools Image cross site scriptingEPSS 0.4%CVE-2024-41725HIGHDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site ScriptingEPSS 0.4%CVE-2024-9440MEDIUMSlim Select 2.0 createOption "text" XSSEPSS 0.4%CVE-2026-86181MEDIUMcode-projects Task Management System User Profile Update UpdateUserProfile.php cross site scriptingEPSS 0.4%CVE-2022-27894MEDIUMThe Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.EPSS 0.4%CVE-2025-55474MEDIUMMany Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.EPSS 0.4%CVE-2025-40992MEDIUMStored XSS in Creativeitem SocioproEPSS 0.4%CVE-2026-95816HIGHSmart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' ParameterEPSS 0.4%CVE-2025-7495MEDIUMWP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-86644MEDIUMstar7th showdoc API Page Save Endpoint editormd.js cross site scriptingEPSS 0.4%CVE-2025-52468HIGHChamilo: Stored XSS Vulnerability via CSV User ImportEPSS 0.4%CVE-2023-2558MEDIUMWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-22855LOWAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient beforEPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%