Falhas do tipo CWE-79

30.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-5319MEDIUMitsourcecode Payroll Management System navbar.php cross site scriptingEPSS 0.3%CVE-2025-11278MEDIUMAllStarLink Supermon AllMon2 cross site scriptingEPSS 0.3%CVE-2026-11594HIGHIBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilitiesEPSS 0.3%CVE-2022-4901LOWMultiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciouEPSS 0.3%CVE-2025-46841MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-12091HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-27740MEDIUMDiscourse has Stored XSS in AI Triage AutomationEPSS 0.3%CVE-2025-46855MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46847MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46844MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46843MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-56410MEDIUMPhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom propertiesEPSS 0.3%CVE-2025-46838MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-3801MEDIUMsongquanpeng one-api System Setting cross site scriptingEPSS 0.3%CVE-2026-5630MEDIUMassafelovic gpt-researcher Report API app.py cross site scriptingEPSS 0.3%CVE-2026-118244HIGHHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printEPSS 0.3%CVE-2022-36244MEDIUMMultiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesEPSS 0.3%CVE-2024-10091MEDIUMElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2026-56809MEDIUMMultiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vEPSS 0.3%CVE-2023-37528MEDIUMA cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformEPSS 0.3%