Falhas do tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2019-12712MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1852MEDIUMCisco Prime Network Registrar Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12631MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12715MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12713MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-44957MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulneraEPSS 1.1%CVE-2020-3156MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-13407—Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgiEPSS 1.1%CVE-2026-56128MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.phpEPSS 1.1%CVE-2026-56127MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.phpEPSS 1.1%CVE-2026-56126MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.phpEPSS 1.1%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.1%CVE-2021-25065—Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.0%CVE-2023-43566LOWIn JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configurationEPSS 1.0%CVE-2022-44946MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?moduleEPSS 1.0%CVE-2021-43785HIGHCross Site Scripting Vulnerability in @joeattardi/emoji-buttonEPSS 1.0%CVE-2022-35651—A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM trEPSS 1.0%CVE-2024-45265CRITICALA SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL cEPSS 1.0%CVE-2022-43185MEDIUMA stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbEPSS 1.0%CVE-2024-54958MEDIUMNagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to EPSS 1.0%