Falhas do tipo CWE-79

28.634 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-21686HIGHThis High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerabiEPSS 0.9%CVE-2024-43476HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%CVE-2021-27658MEDIUMexacqVision Enterprise Manager CSSEPSS 0.9%CVE-2021-4143HIGHCross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebuttonEPSS 0.9%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-39366MEDIUMStored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in CactiEPSS 0.9%CVE-2024-53255MEDIUMReflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMSEPSS 0.9%CVE-2021-24724—Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-2036CRITICALCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2022-1029—Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-25062—Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25015—myCred < 2.4 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25031—Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2020-36635LOWOpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scriptingEPSS 0.9%CVE-2023-28665MEDIUMThe Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page'EPSS 0.9%CVE-2024-45714MEDIUMSolarWinds Serv-U Stored XSS VulnerabilityEPSS 0.9%CVE-2023-21564HIGHAzure DevOps Server Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-25035—Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2017-16721—A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unaEPSS 0.9%