Falhas do tipo CWE-79

28.610 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-30920HIGHCross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.phpEPSS 1.0%CVE-2023-28447HIGHCross site scripting vulnerability in Javascript escaping in smarty/smartyEPSS 1.0%CVE-2020-7318MEDIUMePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerabilityEPSS 1.0%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2020-2496—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2024-25412MEDIUMA cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 1.0%CVE-2024-57522MEDIUMSourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a EPSS 1.0%CVE-2021-41172MEDIUMSelf-XSS in AS_RedisEPSS 1.0%CVE-2025-64672HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.0%CVE-2017-16009—ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AEPSS 1.0%CVE-2026-33346HIGHOpenEMR has stored XSS in portal_payment.php via Unescaped table_argsEPSS 1.0%CVE-2020-8170—We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AiEPSS 1.0%CVE-2021-25929MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2024-22927MEDIUMCross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedEPSS 1.0%CVE-2022-2627MEDIUMNewspaper < 12 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2017-15892—Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated uEPSS 1.0%CVE-2023-26982MEDIUMTrudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create TickeEPSS 1.0%CVE-2022-25601MEDIUMWordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 1.0%CVE-2022-23519HIGHPossible XSS vulnerability with certain configurations of rails-html-sanitizerEPSS 1.0%CVE-2017-16010—i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will EPSS 1.0%