Falhas do tipo CWE-79

28.612 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2017-16767—Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated userEPSS 1.0%CVE-2021-40721MEDIUMAdobe Connect Reflected Cross Site ScriptingEPSS 1.0%CVE-2020-14502MEDIUMThe web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicEPSS 1.0%CVE-2022-23622HIGHCross site scripting in registration template in xwiki-platformEPSS 1.0%CVE-2024-11199MEDIUMRescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar ShortcodeEPSS 1.0%CVE-2022-48311CRITICAL**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model NEPSS 1.0%CVE-2024-9007MEDIUMjeanmarc77 123solar detailed.php cross site scriptingEPSS 1.0%CVE-2021-25017—Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-43701MEDIUMApache Superset: Stored XSS on API endpointEPSS 1.0%CVE-2018-15635MEDIUMCross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteEPSS 1.0%CVE-2020-26198MEDIUMDell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applicaEPSS 1.0%CVE-2026-5615MEDIUMgivanz Vvvebjs File Upload Endpoint upload.php cross site scriptingEPSS 1.0%CVE-2022-37461MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitraryEPSS 1.0%CVE-2020-15276HIGHCross Site Scripting in baserCMSEPSS 1.0%CVE-2022-21715MEDIUMCross-site Scripting Vulnerability in CodeIgniter4EPSS 1.0%CVE-2022-3578MEDIUMProfileGrid < 5.1.1 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2020-15781—A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficientEPSS 1.0%CVE-2024-54133LOWPossible Content Security Policy bypass in Action DispatchEPSS 1.0%CVE-2025-14340HIGHAdmin Account Takeover via malicious URL payloadEPSS 1.0%CVE-2021-20279—The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.EPSS 1.0%