Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-41311MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.0%CVE-2022-23397MEDIUMThe Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent EPSS 1.0%CVE-2007-5817MEDIUMdialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1) del, (2) delbackupEPSS 1.0%CVE-2024-20759HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 1.0%CVE-2020-26239HIGHCross-Site Scripting in Scratch browser addonsEPSS 1.0%CVE-2023-26982MEDIUMTrudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create TickeEPSS 1.0%CVE-2024-30920HIGHCross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.phpEPSS 1.0%CVE-2022-44951MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.phEPSS 1.0%CVE-2026-83662CRITICALAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.0%CVE-2026-22704HIGHHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverEPSS 1.0%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2020-2496—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2022-3572CRITICALA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, andEPSS 1.0%CVE-2022-42118MEDIUMA Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixEPSS 1.0%CVE-2024-25412MEDIUMA cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 1.0%CVE-2021-41172MEDIUMSelf-XSS in AS_RedisEPSS 1.0%CVE-2020-8170—We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AiEPSS 1.0%CVE-2021-25929MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2022-34257MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 1.0%CVE-2024-22927MEDIUMCross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedEPSS 1.0%