Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-54958MEDIUMNagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to EPSS 1.0%CVE-2023-30838HIGHPrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML methodEPSS 1.0%CVE-2025-26064HIGHA cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts oEPSS 1.0%CVE-2021-25933MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2024-51135CRITICALAn XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensEPSS 1.0%CVE-2024-23111MEDIUMAn improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and EPSS 1.0%CVE-2023-34222MEDIUMIn JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possibleEPSS 1.0%CVE-2023-34226MEDIUMIn JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleEPSS 1.0%CVE-2023-39175MEDIUMIn JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleEPSS 1.0%CVE-2021-28625MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jspEPSS 1.0%CVE-2022-1346CRITICALMultiple Stored XSS in causefx/organizrEPSS 1.0%CVE-2023-38065MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possibleEPSS 1.0%CVE-2023-38061MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possibleEPSS 1.0%CVE-2023-6697MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2021-28628MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox render.jspEPSS 1.0%CVE-2022-1344CRITICALStored XSS due to no sanitization in the filename in causefx/organizrEPSS 1.0%CVE-2023-34221MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possibleEPSS 1.0%CVE-2023-38063MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possibleEPSS 1.0%CVE-2020-26216HIGHCross-Site Scripting in TYPO3 FluidEPSS 1.0%CVE-2022-29091MEDIUMDell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in UnisphEPSS 1.0%