Falhas do tipo CWE-79

30.672 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-23519HIGHPossible XSS vulnerability with certain configurations of rails-html-sanitizerEPSS 1.1%CVE-2022-44947MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?moEPSS 1.1%CVE-2019-13407—Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgiEPSS 1.1%CVE-2022-1320—Sliderby10Web < 1.2.52 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-1394—Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-56126MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.phpEPSS 1.1%CVE-2024-57522MEDIUMSourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a EPSS 1.1%CVE-2022-1564—Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-56127MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.phpEPSS 1.1%CVE-2026-56128MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.phpEPSS 1.1%CVE-2022-43425MEDIUMJenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters onEPSS 1.1%CVE-2023-34229MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possibleEPSS 1.0%CVE-2022-44950MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?mEPSS 1.0%CVE-2023-43566LOWIn JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configurationEPSS 1.0%CVE-2026-100133CRITICALAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 1.0%CVE-2022-44949MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?mEPSS 1.0%CVE-2021-43785HIGHCross Site Scripting Vulnerability in @joeattardi/emoji-buttonEPSS 1.0%CVE-2017-0931—html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.EPSS 1.0%CVE-2024-45265CRITICALA SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL cEPSS 1.0%CVE-2024-54959MEDIUMNagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-EPSS 1.0%