Falhas do tipo CWE-79

28.635 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-11201MEDIUMmyCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send ShortcodeEPSS 0.9%CVE-2022-2890CRITICALCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.9%CVE-2016-9130—Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,EPSS 0.9%CVE-2021-38356MEDIUMNextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-0282LOWKashipara Food Management System addmaterialsubmit.php cross site scriptingEPSS 0.9%CVE-2021-43558—A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in thEPSS 0.9%CVE-2021-21340MEDIUMCross-Site Scripting in Content PreviewEPSS 0.9%CVE-2021-21358MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formEPSS 0.9%CVE-2021-21370MEDIUMCross-Site Scripting in Content Preview (CType menu)EPSS 0.9%CVE-2017-12307—A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coEPSS 0.9%CVE-2023-0742HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.9%CVE-2025-56432MEDIUMA cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScEPSS 0.9%CVE-2024-34224HIGHCross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allEPSS 0.9%CVE-2023-0741HIGHCross-site Scripting (XSS) - DOM in answerdev/answerEPSS 0.9%CVE-2021-43841MEDIUMXSS by SVG upload in xwiki-platformEPSS 0.9%CVE-2022-1571CRITICALCross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsEPSS 0.9%CVE-2025-14499HIGHIceWarp gmaps Cross-Site Scripting Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-33977HIGHStored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSEPSS 0.9%CVE-2022-0501HIGHCross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_consoleEPSS 0.9%CVE-2023-0625HIGHDocker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelogEPSS 0.9%