Falhas do tipo CWE-79

30.355 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24563—Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 26.3%CVE-2025-12101MEDIUMCross-Site Scripting (XSS)EPSS 26.3%CVE-2007-4465MEDIUMCross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated pEPSS 26.2%CVE-2024-24494MEDIUMCross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, prEPSS 25.9%CVE-2024-7008MEDIUMCalibre Reflected Cross-Site Scripting (XSS)EPSS 25.6%CVE-2023-47505MEDIUMWordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)EPSS 25.3%CVE-2025-8155MEDIUMD-Link DCS-6010L Management Application vb.htm cross site scriptingEPSS 25.3%CVE-2024-43365MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 25.1%CVE-2024-27443MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite EPSS 24.6%KEVCVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2020-2036HIGHPAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interfaceEPSS 23.9%CVE-2023-34941MEDIUMA stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to executEPSS 23.8%CVE-2022-29455MEDIUMWordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 23.7%CVE-2020-8191—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 23.5%CVE-2024-3378MEDIUMiboss Secure Web Gateway Login Portal login cross site scriptingEPSS 23.1%CVE-2024-39123MEDIUMIn janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizEPSS 23.1%CVE-2018-19943HIGHIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these isEPSS 22.7%KEVCVE-2014-2120MEDIUMCross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackerEPSS 22.6%KEVCVE-2024-44309MEDIUMA cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, EPSS 21.9%KEVCVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 21.3%