Falhas do tipo CWE-79

28.445 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-43362HIGHStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 38.6%CVE-2024-43364MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 37.9%CVE-2024-22241MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious pEPSS 37.8%CVE-2023-0563LOWPHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scriptingEPSS 37.6%CVE-2024-50352MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phpEPSS 37.6%CVE-2021-20323—A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.EPSS 37.2%CVE-2021-21087MEDIUMColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browserEPSS 37.1%CVE-2023-46127MEDIUMFrappe vulnerable to HTML injection by any Desk userEPSS 37.0%CVE-2018-5550—Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allowEPSS 36.9%CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2024-42008CRITICALA Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attEPSS 35.9%CVE-2025-0370MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src ParameterEPSS 35.6%CVE-2024-32479HIGHLibreNMS's Improper Sanitization on Service template name leads to Stored XSSEPSS 34.1%CVE-2025-10573CRITICALStored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptEPSS 33.5%CVE-2024-4901HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 33.0%CVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2020-35730MEDIUMAn XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain EPSS 32.7%KEVCVE-2024-21725MEDIUM[20240204] - Core - XSS in mail address outputsEPSS 32.2%CVE-2023-24322MEDIUMA reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbEPSS 31.7%CVE-2025-30349HIGHHorde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tEPSS 31.3%