Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-48311CRITICAL**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model NEPSS 1.0%CVE-2025-47777CRITICAL5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)EPSS 1.0%CVE-2020-36636LOWOpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingEPSS 1.0%CVE-2021-25017—Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2018-15635MEDIUMCross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteEPSS 1.0%CVE-2023-43701MEDIUMApache Superset: Stored XSS on API endpointEPSS 1.0%CVE-2020-26198MEDIUMDell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applicaEPSS 1.0%CVE-2023-7312MEDIUMNagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmailEPSS 1.0%CVE-2025-52875MEDIUMIn JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possibleEPSS 1.0%CVE-2024-54133LOWPossible Content Security Policy bypass in Action DispatchEPSS 1.0%CVE-2022-21715MEDIUMCross-site Scripting Vulnerability in CodeIgniter4EPSS 1.0%CVE-2020-15276HIGHCross Site Scripting in baserCMSEPSS 1.0%CVE-2020-15781—A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficientEPSS 1.0%CVE-2017-2607MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). JenkinEPSS 1.0%CVE-2021-24955—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2022-21710MEDIUMCross-site Scripting in ShortDescription extensionEPSS 1.0%CVE-2022-23081—Openlibrary - Reflected XSSEPSS 1.0%CVE-2021-24954—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2022-30120—XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insuffEPSS 1.0%CVE-2018-16887MEDIUMA cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations aEPSS 1.0%