Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24365—Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom FieldEPSS 0.9%CVE-2020-10748—A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flawEPSS 0.9%CVE-2021-39340MEDIUMNotification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-32852MEDIUMcountly-server vulnerable to Cross-site ScriptingEPSS 0.9%CVE-2022-0233MEDIUMProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-45916MEDIUMILIAS before 7.16 allows XSS.EPSS 0.9%CVE-2022-43143CRITICALA cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafteEPSS 0.9%CVE-2025-54534MEDIUMIn JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset pageEPSS 0.9%CVE-2018-3771—An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browseEPSS 0.9%CVE-2018-3773—There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.EPSS 0.9%CVE-2021-39136HIGHCross-site scripting vulnerability in file uploadEPSS 0.9%CVE-2017-6618—A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tEPSS 0.9%CVE-2024-39143MEDIUMA stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propertEPSS 0.9%CVE-2020-29444MEDIUMAffected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross SitEPSS 0.9%CVE-2017-12269—A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-siteEPSS 0.9%CVE-2025-46199CRITICALCross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the formEPSS 0.9%CVE-2021-41252HIGHCross-site scripting (XSS) from writer field content in the site frontendEPSS 0.9%CVE-2024-25503MEDIUMCross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensEPSS 0.9%CVE-2017-12344—Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into EPSS 0.9%CVE-2022-23518MEDIUMImproper neutralization of data URIs allows XSS in rails-html-sanitizerEPSS 0.9%