Falhas do tipo CWE-79

29.882 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-0981HIGHOkta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs wheEPSS 0.4%CVE-2026-104900MEDIUMMISP Stored XSS via Unescaped Count Field Value in Remote Event Preview IndexEPSS 0.4%CVE-2024-6082MEDIUMPHPVibe Global Options Page functionalities.global.php cross site scriptingEPSS 0.4%CVE-2026-9280MEDIUMAd Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe ModeEPSS 0.4%CVE-2026-103321HIGHMISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImageEPSS 0.4%CVE-2022-45758MEDIUMSENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.EPSS 0.4%CVE-2024-30433MEDIUMWordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29775MEDIUMWordPress Frontend Dashboard plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-71388MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75667MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-48260MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-48257MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75694MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-34413MEDIUMWordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-48253MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-48415MEDIUMitsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlEPSS 0.4%CVE-2026-75670MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2026-75685MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-30452MEDIUMWordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-19713MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%