Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2021-39328MEDIUMSimple Job Board <= 2.9.4 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-39357MEDIUMLeaky Paywall <= 4.16.5 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2015-20019—Content text slider on post < 6.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.9%CVE-2022-0719HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 0.9%CVE-2020-8292—Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in messagEPSS 0.9%CVE-2026-51133MEDIUMCross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary codEPSS 0.9%CVE-2021-41086HIGHClipboard-based XSS in jsuitesEPSS 0.9%CVE-2018-18997—Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrativEPSS 0.9%CVE-2022-4212MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfEPSS 0.9%CVE-2017-20008—myCRED < 1.7.8 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-3850MEDIUMUniview NVR301-04S2-P4 Cross-site ScriptingEPSS 0.9%CVE-2022-4208MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefEPSS 0.9%CVE-2022-3873MEDIUMCross-site Scripting (XSS) - DOM in jgraph/drawioEPSS 0.9%CVE-2022-4209MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfEPSS 0.9%CVE-2022-4210MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfEPSS 0.9%CVE-2022-4211MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfEPSS 0.9%CVE-2022-2407—WP phpMyAdmin < 5.2.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-26105—SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unautheEPSS 0.9%CVE-2018-3755—XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element uEPSS 0.9%