Falhas do tipo CWE-79

28.618 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-39346MEDIUMGoogle Maps Easy <= 1.9.33 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2023-4202CRITICALStored Cross-Site ScriptingEPSS 1.0%CVE-2025-25612HIGHFS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration funcEPSS 1.0%CVE-2018-18985—Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2EPSS 1.0%CVE-2025-69210LOWFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadEPSS 1.0%CVE-2020-8198—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 1.0%CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2025-52875MEDIUMIn JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possibleEPSS 1.0%CVE-2023-35054MEDIUMIn JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleEPSS 1.0%CVE-2024-33338HIGHCross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publicEPSS 1.0%CVE-2017-7422—Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise SeEPSS 1.0%CVE-2021-38320MEDIUMsimpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site ScriptingEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2022-34257MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 1.0%CVE-2023-35394MEDIUMAzure HDInsight Jupyter Notebook Spoofing VulnerabilityEPSS 1.0%CVE-2021-24954—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2025-51396MEDIUMA stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via inEPSS 1.0%CVE-2020-7690—All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via theEPSS 1.0%CVE-2021-24955—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2021-43409CRITICALWPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site ScriptingEPSS 1.0%