Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-51502MEDIUMReflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScriEPSS 0.9%CVE-2019-11776—In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's bEPSS 0.9%CVE-2022-46147HIGHDrag and Drop XBlock v2 has XSS Issues in Xblock Input FieldsEPSS 0.9%CVE-2024-31063MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.9%CVE-2022-42967HIGHXSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown filesEPSS 0.9%CVE-2017-13994—A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validatioEPSS 0.9%CVE-2021-34651MEDIUMScribble Maps <= 1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38335MEDIUMWise Agent Capture Forms <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38348MEDIUMAdvance Search <= 1.1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38351MEDIUMOSD Subscribe <= 1.2.3 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38331MEDIUMWP-T-Wap <= 1.13.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38334MEDIUMWP Design Maps & Places <= 1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34649MEDIUMSimple Behance Portfolio <= 0.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38319MEDIUMMore From Google <= 0.0.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34654MEDIUMCustom Post Type Relations <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38326MEDIUMPost Title Counter <= 1.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38339MEDIUMSimple Matted Thumbnails <= 1.01 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38340MEDIUMWordpress Simple Shop <= 1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38336MEDIUMEdit Comments XT <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38328MEDIUMNotices <= 6.1 Reflected Cross-Site ScriptingEPSS 0.9%